Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

4.2.4  Circuit Breaker Reset Philosophy

In recent years, aircraft manufacturers and operators have identified improper CB reset procedures. Consequently, they have taken positive steps to determine the most appropriate philosophy governing the resetting of CBs and to communicate that philosophy to pilots and technicians. The FAA 's Flight Standards Information Bulletin has also served to normalize the approach to the resetting of CBs taken by operators and their personnel, specifically flight crews, maintenance personnel, and ground servicing personnel.

TC relayed its position on the resetting of CBs in an issue of the Aviation Safety Letter, whose distribution is limited to Canadian licensed pilots. Awareness about such "best practices" appears to be increasing; however, the regulatory environment remains unchanged. At this time, requirements and guidance material do not include a clear and unambiguous message stipulating the acceptable CB reset philosophy, and the consequences of an inappropriate CB reset.

The Board believes that despite these initiatives, if the existing regulatory environment is not amended to reflect the acceptable CB reset philosophy, such "best practices" will not be universally applied across the aviation industry and ultimately, the positive changes currently established may not be maintained. Therefore, the Board recommends that

Regulatory authorities establish the requirements and industry standard for circuit breaker resetting.
A03-05

Assessment/Reassessment Rating: Fully Satisfactory

Previous | Next

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

4.2.5  Accident Investigation Issues

  1. 4.2.5.1 - Quality of CVR Recording
  2. 4.2.5.2 - Quick Access Recorder Data
  3. 4.2.5.3 - Image (Video) Recording

4.2.5.1  Quality of CVR Recording

Frequently, the CVR recording of cockpit conversations are of poor quality, particularly when the conversations are recorded through the CAM. The voice quality on CVR recordings is dramatically improved when voices are recorded through boom microphones. However, pilots are not required to wear headsets with boom microphones at cruising altitudes.

Various national regulations differ concerning the maximum altitudes below which flight crews are required to wear boom microphones. For example, the CARs require the use of boom microphones below 10 000 feet, the FARs below 18 000 feet and the Joint Aviation Requirements do not have any requirement that they be used. Swissair required their pilots to use boom microphones when flying below 15 000 feet. The present requirements were developed before modern technology allowed headsets with boom microphones to be designed for comfort over long periods of time, such as during cruise flight.

When the SR 111 pilots first noted an odour in the cockpit, they were in cruise flight and were not wearing boom microphones. Although the internal communications between the pilots were recorded through the CAM, the conversations were difficult to hear and decipher. There was a marked improvement in recording quality after the pilots donned their oxygen masks, which have built-in microphones.

Even though the boom or oxygen mask microphones are recorded on a different channel than the CAM, the recordings of internal communications on the microphone channels are still frequently masked by incoming radio transmissions because internal, as well as external, communications are recorded on the same CVR channels but at different amplitudes. For example, the recorded incoming radio communications for SR 111 were of significantly higher amplitude than the internal communication from the mask microphone, making it difficult and occasionally impossible to discern internal communications. The relative amplitude of the incoming radio calls to that of the internal communications is pre-set at equipment installation and is not affected by crew adjustment of audio volume. Therefore, even if the pilots can hear each other readily through their headsets, the CVR recording of internal communications may be masked substantially by incoming radio communications. Significant difficulties in extracting such "masked" internal communications from CVR recordings have been experienced by the TSB and by safety investigation agencies from other nations.

The ability to decipher internal conversations between flight crew members is an important element of effective accident investigation. Therefore, the Board recommends that

Regulatory authorities, in concert with the aviation industry, take measures to enhance the quality and intelligibility of CVR recordings.
A03-06

Assessment/Reassessment Rating: Satisfactory in Part

4.2.5.2  Quick Access Recorder Data

Quick access recorders (QAR) are voluntarily installed in many transport aircraft and routinely record far more data than the mandatory FDR. For example, the FDR installed on SR 111 was a solid state unit that recorded approximately 250 parameters, whereas the QAR used a tape-based cartridge, which recorded approximately 1 500 parameters. That is, the optional QAR recorded six times the amount of data recorded on the mandatory FDR. The additional data recorded on the QAR included numerous inputs from line replaceable units (LRU) that would have been extremely valuable in determining aircraft systems status, as well as temperatures at a number of locations in the fire-damaged area.

Many airlines are developing Flight Operational Quality Assurance (FOQA) or Flight Data Monitoring (FDM) programs; such programs require that increased data sets be recorded. The use of QARs is voluntary; therefore, the operating environment allows operators to change the QAR data-set according to their operational requirements. Conversely, changing the data-set on an FDR is currently an expensive process, largely due to the associated re-certification issues. As modern-day versions of both types of recorders employ solid state memory technologies, these modern FDRs effectively have as much capacity to record data as QARs. The Board believes that there is no technical reason why safety investigations should not benefit from the FOQA/FDM trend, and that all data voluntarily collected for any operational purpose should also be available for accident investigation. To achieve this, regulatory authorities need to develop regulations that protect the core parameters required for all FDRs, while also allowing FDRs to be easily augmented with additional parameters, higher sample rates, and higher resolutions without requiring re-certification of the FDR and without requiring validation/calibration of parameters that are not dedicated to the FDR. Operators would need ready access to these FOQA/FDM parameters and might choose to use only the FDR unit to meet the mandatory FDR parameter list, as well as their optional FOQA/FDM data needs.

The Board recognizes that the US convened a Future Flight Data Collection Committee to address these issues, and that in Europe, the European Organisation for Civil Aviation Equipment (EUROCAE) Working Group 50 is updating its international Minimum Operational Performance Specifications. The Board supports FOQA and FDM programs and believes that they contribute significantly toward improving aviation safety. The Board also believes that all FOQA and FDM data routinely collected should be available for safety investigations. Therefore, the Board recommends that:

Regulatory authorities require, for all aircraft manufactured after 1 January 2007 which require an FDR, that in addition to the existing minimum mandatory parameter lists for FDRs, all optional flight data collected for non-mandatory programs such as FOQA/FDM, be recorded on the FDR.
A03-07

Assessment/Reassessment Rating: Unsatisfactory

4.2.5.3  Image (Video) Recording

Only recently has it become economically feasible to record cockpit images in a crash-protected memory device. New "immersive" technology provides for camera systems that can capture panoramic, wide-angle views necessary to record the cockpit environment. Image recordings can capture other aspects of the cockpit environment that would otherwise be impractical or impossible to record. Special playback software allows investigators to "immerse" themselves in the cockpit and view virtually the entire flight deck.

Vital information regarding the cockpit environment, non-verbal crew communications, crew workload, instrument display selections and status have not been available on traditional data and voice recorders. This has limited the scope of many investigations, but more importantly, has hindered the identification of safety issues and consequently the corrective action needed to prevent future occurrences.

Some operators are installing video cameras for operational purposes. These systems provide the flight crew with images, such as the external views of the undercarriage area, wings and engines, or internal views of cargo and cabin areas. Since these video images have the potential to influence critical operational decisions, the images presented to the flight crew should be stored in crash-protected memory to facilitate safety investigations.

The Board believes that image recording in the cockpit will substantially benefit safety investigations. It will provide investigators with a reliable and objective means of expeditiously determining what happened. This will assist safety investigators in focusing on why events took the course they did, what risks exist in the system, and how best to eliminate those risks in the future.

The Board endorses the NTSB recommendations issued in April 2000 (A-00-30 and A-00-31), and advocates the development of international Minimum Operational Performance Specifications for image recording systems by EUROCAE Working Group 50. Therefore, the Board recommends that:

Regulatory authorities develop harmonized requirements to fit aircraft with image recording systems that would include imaging within the cockpit.
A03-08

Assessment/Reassessment Rating: Satisfactory Intent

The Board is acutely aware of the concerns expressed by industry associations that sensitive recordings will be inappropriately released to the public or used for purposes other than safety investigation. While Canada treats these recordings as privileged, all nations do not. If image recordings are to be universally accepted, worldwide protections need to be put in place for all cockpit voice and image recordings. These protections would allow investigation authorities to use the recordings for safety purposes while preventing them from being aired for other purposes. Therefore, the Board recommends that:

Regulatory authorities harmonize international rules and processes for the protection of cockpit voice and image recordings used for safety investigations.
A03-09

Assessment/Reassessment Rating: Satisfactory Intent

Previous | Next

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

Hollow Tube Burn Test

This page provides access to a video clip showing a hollow tube burn test. The clip is in MPEG format and can be viewed using many widely available viewers, including Windows Media Player and Apple QuickTime Player.

burntest_hollowtube.mpg (8 876 kB)

Return to the STI document

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

Electrical Wire Arc Tests - ETFE Insulation

This page provides access to a video clip showing arcing of a wire with ETFE insulation. The clip is in MPEG format and can be viewed using many widely available viewers, including Windows Media Player and Apple QuickTime Player.

ETFE_arcing.mpg (19 950 kB)

Return to the STI document

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

Hook-and-Loop Burn Test

This page provides access to a video clip showing a hook-and-loop burn test. The clip is in MPEG format and can be viewed using many widely available viewers, including Windows Media Player and Apple QuickTime Player.

hookandloopburntest.mpg (8 941 kB)

Return to the STI document

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

Electrical Wire Arc Tests - Polyimide Insulation

This page provides access to a video clip showing arcing of a wire with polyimide insulation. The clip is in MPEG format and can be viewed using many widely available viewers, including Windows Media Player and Apple QuickTime Player.

polyimide_arcing.mpg (5 217 kB)

Return to the STI document

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

MPET-Covered Insulation Blanket Burn Test

This page provides access to a video clip showing the MPET-covered insulation blanket burn test. The clip is in MPEG format and can be viewed using many widely available viewers, including Windows Media Player and Apple QuickTime Player.

mpetblanketburntest.mpg (5 947 kB)

Return to the STI document

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

  AVIATION REPORTS - 1998 - A98H0003

The Transportation Safety Board of Canada (TSB) investigated this occurrence for the purpose of advancing transportation safety. It is not the function of the Board to assign fault or determine civil or criminal liability.

Aviation Investigation Report

In-Flight Fire Leading to Collision with Water
Swissair Transport Limited
McDonnell Douglas MD-11 HB-IWF
Peggy’s Cove, Nova Scotia 5 nm SW
2 September 1998

Report Number A98H0003

Synopsis

On 2 September 1998, Swissair Flight 111 departed New York, United States of America, at 2018 eastern daylight savings time on a scheduled flight to Geneva, Switzerland, with 215 passengers and 14 crew members on board. About 53 minutes after departure, while cruising at flight level 330, the flight crew smelled an abnormal odour in the cockpit. Their attention was then drawn to an unspecified area behind and above them and they began to investigate the source. Whatever they saw initially was shortly thereafter no longer perceived to be visible. They agreed that the origin of the anomaly was the air conditioning system. When they assessed that what they had seen or were now seeing was definitely smoke, they decided to divert. They initially began a turn toward Boston; however, when air traffic services mentioned Halifax, Nova Scotia, as an alternative airport, they changed the destination to the Halifax International Airport. While the flight crew was preparing for the landing in Halifax, they were unaware that a fire was spreading above the ceiling in the front area of the aircraft. About 13 minutes after the abnormal odour was detected, the aircraft's flight data recorder began to record a rapid succession of aircraft systems-related failures. The flight crew declared an emergency and indicated a need to land immediately. About one minute later, radio communications and secondary radar contact with the aircraft were lost, and the flight recorders stopped functioning. About five and one-half minutes later, the aircraft crashed into the ocean about five nautical miles southwest of Peggy's Cove, Nova Scotia, Canada. The aircraft was destroyed and there were no survivors.

Ce rapport est également disponible en français.

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

How This Report Is Organized

This report was prepared in accordance with International Civil Aviation Organization standards and recommended practices,[*] and with Transportation Safety Board (TSB) standards for investigation reports. In keeping with these standards, the report is organized into the following main parts:

  • Part 1, Factual Information: Provides objective information that is pertinent to the understanding of the circumstances surrounding the occurrence.
  • Part 2, Analysis: Discusses and evaluates the factual information presented in Part 1 that the Board considered when formulating its conclusions and safety actions.
  • Part 3, Conclusions: Based on the analyses of the factual information, presents three categories of findings: findings as to causes and contributing factors to the occurrence; findings that expose risks that have the potential to degrade aviation safety, but that could not be shown to have played a direct role in the occurrence; and "other" findings that have the potential to enhance safety, or clarify issues of unresolved ambiguity or controversy.
  • Part 4, Safety Action: Based on the findings of the investigation, recommends safety actions required to be taken to eliminate or mitigate safety deficiencies, and records the main actions already taken or being taken by the stakeholders involved.

Note: Owing to the scope of the Swissair 111 investigation, various supporting technical information (STI) materials are referenced throughout the report. STI materials are peripheral to the report and are not required to develop a complete understanding of the facts, analyses, conclusions, or recommended safety actions. Rather, the STI materials expand, in technical detail, on the information provided in the report. A superscript "STIx-yyy" is inserted into the report wherever such a reference exists. In the hard-copy version, the number "x" identifies the part of the report, and "yyy" identifies the reference within the part, as indicated in Appendix E – List of Supporting Technical Information References. In the electronic version of the report, such references are hyperlinked directly to the applicable location in the electronic version of the STI. Appendix E is not included in the electronic version.

The report also consists of the following appendices and background material, which are referenced in the report:

  • Appendix A – Flight Profile: Selected Events: A chronological depiction of the intended itinerary, actual flight profile, and selected events during the occurrence, presented in Coordinated Universal Time (UTC).
  • Appendix B – Swissair Air Conditioning Smoke Checklist: The checklist used by Swissair to isolate a source of smoke originating from an aircraft air conditioning system.
  • Appendix C – Swissair Smoke/Fumes of Unknown Origin Checklist: The checklist used by Swissair to isolate a source of smoke or fumes originating from an unknown source.
  • Appendix D – Timeline: A chronological list of events for the duration of the occurrence, presented in UTC.
  • Glossary: An alphabetical list of abbreviations, acronyms, and initialisms used throughout the report.

Available Formats

The report can be viewed in the following formats:

  • Paper.
  • Compact Disc (CD-ROM) attached to the back cover of the paper report (compatible with Microsoft® Windows 95® or higher).
  • On the TSB web site at http://www.bst-tsb.gc.ca.

The STI materials can be viewed:

  • On the TSB web site at http://www.bst-tsb.gc.ca.
  • On Compact Disc (CD-ROM) along with the investigation report (compatible with Microsoft® Windows 95® or higher).

Readers can print copies of the report and STI materials from the CD-ROM or TSB web site.

To obtain additional copies of the report, please contact

TSB Communications Division
Place du Centre
200 Promenade du Portage
4th Floor
Gatineau, Quebec K1A 1K8
Canada

Telephone: (819) 994-3741
Fax: (819) 997-2239
E-mail: communications@bst-tsb.gc.ca

[*]  For more detailed information on International Civil Aviation Organization standards, refer to International Standards and Recommended Practices, Annex 13 to the Convention on International Civil Aviation, Aircraft Accident and Incident Investigation, Ninth Edition, July 2001.

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

4.2.3  IFEN – Supplemental Type Certificate Process

Based on information highlighted by this accident, the FAA has initiated many positive changes to its type certification process. However, there is one area that the Board feels requires additional consideration.

The purpose of FAR 25.1309 is to confirm that a system's design does not adversely affect the original aircraft type certificate. This investigation identified a deficiency with the provisions of FAR 25.1309, which allowed the IFEN STC ST00236LA-D system-to-aircraft integration design to be approved without confirmation that it was compliant with the aircraft's original type certificate. The Board is aware that there were other STC designs, certified in accordance with FAR 25.1309, in which the system-to-aircraft integration design introduced latent unsafe conditions with the potential to adversely impact the operation of the aircraft during emergency procedures. In some instances, the STC process allowed the intended function of certain checklist procedures during abnormal or emergency situations, to be altered without issuing an Airplane Flight Manual (AFM) supplement to advise the pilots. Although FAR 25.1309 applies to all aircraft systems, it would appear that STC designs that have been typically viewed as "non-essential, non-required"and that can be approved based on a qualitative assessment, are especially susceptible to improper integration.

The Board believes that, as currently written, FAR 25.1309 can be interpreted to allow STC approval of system-to-aircraft integration designs that are not compliant with the original type certification. Therefore, the Board recommends that:

Regulatory authorities require that every system installed through the STC process, undergo a level of quantitative analysis to ensure that it is properly integrated with aircraft type-certified procedures, such as emergency load-shedding.
A03-04

Assessment/Reassessment Rating: Satisfactory in Part

Previous | Next

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada
Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

Glossary

A | B | C | D | E | F | G | H | I | J | K | L | M | N | O | P | Q | R | S | T | U | V | W | X | Y | Z | Symbols  

< Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

  AVIATION REPORTS - 1998 - A98H0003

Table of Contents

  1. How This Report Is Organized
  2. 1.0 Factual Information
  3. 2.0 Analysis
  4. 3.0 Conclusions
  5. 4.0 Safety Action
  6. 5.0 Appendices
  7. List of Figures

How This Report Is Organized

  1. How This Report Is Organized

1.0 Factual Information

  1. 1.0 Factual Information
  2. 1.1 History of the Flight
  3. 1.2 Injuries to Persons
  4. 1.3 Damage to Aircraft
  5. 1.4 Other Damage
  6. 1.5 Personnel Information
  7. 1.5.1 General
  8. 1.5.2 Flight Crew
  9. 1.5.3 Cabin Crew
  10. 1.5.4 Seventy-Two-Hour History
  11. 1.5.5 Air Traffic Controllers
  12. 1.6 Aircraft Information
    1. 1.6.1 General
    2. 1.6.2 Environmental (Air) System
    3. 1.6.3 Ditching Mode
    4. 1.6.4 Auto Flight System
    5. 1.6.5 Electronic Instrument System
    6. 1.6.6 Flight Management System
    7. 1.6.7 Warnings and Alerts
    8. 1.6.8 Standby Flight Instruments
    9. 1.6.9 Communications Systems
    10. 1.6.10 Electrical System
    11. 1.6.11 In-Flight Entertainment Network
    12. 1.6.12 Aircraft Fire Protection System
    13. 1.6.13 Flight Control System
    14. 1.6.14 Fuel System
    15. 1.6.15 Hydraulic System
    16. 1.6.16 Cockpit Windows
    17. 1.6.17 Landing Gear
    18. 1.6.18 Aircraft Interior Lighting
    19. 1.6.19 Emergency Equipment
    20. 1.6.20 Powerplants
    21. 1.6.21 Landing Performance
    22. 1.6.22 Aircraft Maintenance Records and Inspection
  13. 1.7 Meteorological Information
    1. 1.7.1 General
    2. 1.7.2 Forecast Weather
    3. 1.7.3 Actual Reported Weather
    4. 1.7.4 Upper Level Wind
    5. 1.7.5 Weather Briefing
    6. 1.7.6 Weather Conditions on Departure from JFK
    7. 1.7.7 Weather Conditions during Descent
  14. 1.8 Aids to Navigation
  15. 1.9 Communications
    1. 1.9.1 General
    2. 1.9.2 Controller Training
    3. 1.9.3 Transition Procedures and Controller Communications
    4. 1.9.4 Emergency Communications
    5. 1.9.5 Air Traffic Services Communication Regarding Fuel Dumping
  16. 1.10 Aerodrome Information
  17. 1.11 Flight Recorders
    1. 1.11.1 General
    2. 1.11.2 Recorder Installation Power Requirements
    3. 1.11.3 Stoppage of Recorders
    4. 1.11.4 Lack of CVR Information
    5. 1.11.5 Quick Access Recorder
    6. 1.11.6 Lack of Image Recording
  18. 1.12 Wreckage and Impact Information
    1. 1.12.1 Wreckage Recovery
    2. 1.12.2 Aircraft Wreckage Examination
    3. 1.12.3 Examination of Recovered Electrical Wires and Components
    4. 1.12.4 Examination of Flight Crew Reading Lights (Map Lights)
    5. 1.12.5 Examination of Cabin Overhead Aisle and Emergency Light
    6. Assemblies
    7. 1.12.6 Examination of Standby Instruments
    8. 1.12.7 Examination of Flight Controls
    9. 1.12.8 Examination of Fuel System Components
    10. 1.12.9 Examination of the Engines
    11. 1.12.10 Examination of Aircraft Structural Components
    12. 1.12.11 Examination of Flight Crew and Passenger Seats
    13. 1.12.12 Aircraft Attitude and Airspeed at the Time of Impact
  19. 1.13 Medical Information
    1. 1.13.1 Recovery of Occupants
    2. 1.13.2 Identification of Individuals
    3. 1.13.3 Injury Patterns
    4. 1.13.4 Toxicological Information
  20. 1.14 Fire
    1. 1.14.1 Aircraft Certification Standards
    2. 1.14.2 Review of In-Flight Fire Accident Data
    3. 1.14.3 Designated Fire Zones and Smoke/Fire Detection and Suppression
    4. 1.14.4 Time Required to Troubleshoot in Odour/Smoke Situations
    5. 1.14.5 Risk of Remaining Airborne – Emergency Landing
    6. 1.14.6 Integrated Firefighting Measures
    7. 1.14.7 Airflow Patterns
    8. 1.14.8 Describing the SR 111 Fire-Damaged Area
    9. 1.14.9 Determination of Heat Damage
    10. 1.14.10 Assessment of Fire Damage
    11. 1.14.11 Potential Ignition Sources
    12. 1.14.12 Fire Propagating Materials
    13. 1.14.13 Potential Increased Fire Risk from Non-fire-hardened AircraftSystems
  21. 1.15 Survival Aspects
  22. 1.16 Tests and Research
    1. 1.16.1 AES Examinations of the Recovered Arced Beads
    2. 1.16.2 Map Light Testing and Research
    3. 1.16.3 Airflow Flight Tests
    4. 1.16.4 Analysis of Cockpit Sounds Recorded on the CVR
    5. 1.16.5 Simulator Trials
    6. 1.16.6 Theoretical Emergency Descent Calculations
    7. 1.16.7 Statistics for Occurrences Involving Smoke or Fire
    8. 1.16.8 Electrical Ignition Tests of MPET-Covered Insulation Blankets
    9. 1.16.9 Computer Fire Modelling
  23. 1.17 Organizational and Management Information
    1. 1.17.1 SAirGroup/Swissair/SR Technics
    2. 1.17.2 Swissair Federal Office for Civil Aviation
    3. 1.17.3 Federal Aviation Administration
    4. 1.17.4 The Boeing Company
  24. 1.18 Other Relevant Information
    1. 1.18.1 Swissair Training
    2. 1.18.2 Swissair Checklists for In-Flight Firefighting
    3. 1.18.3 Availability of Published Approach Charts
    4. 1.18.4 Wire-Related Issues
    5. 1.18.5 Circut Protection Devices
    6. 1.18.6 High-Intensity Radiated Fields
    7. 1.18.7 In-Flight Entertainment Network
    8. 1.18.8 Chronological Sequence of Events
    9. 1.18.9 Witness Information
    10. 1.18.10 Reporting of Cabin Anomalies
  25. 1.19 Useful or Effective Investigation Techniques
    1. 1.19.1 Exhibit Tracking Process
    2. 1.19.2 Data Analysis Tools
    3. 1.19.3 Partial Aircraft Reconstruction
    4. 1.19.4 Electrical Wire Arc Sites Analysis
    5. 1.19.5 Temperature Reference Coupons
    6. 1.19.6 Speech Micro-coding Analysis
    7. 1.19.7 Fuel Detection by Laser Environmental Airborne Fluorosensor
    8. 1.19.8 Aircraft Engine Analysis
    9. 1.19.9 Restoration and Extraction of Non-volatile-memory information
    10. 1.19.10 Use of Computer Fire Modelling

2.0 Analysis

  1. 2.0 Analysis
  2. 2.1 General Information
  3. 2.2 On-Board Data Recording Capability
    1. 2.2.1 General
    2. 2.2.2 Cockpit Voice Recorder
    3. 2.2.3 Survivability of Quick Access Recorder Information
    4. 2.2.4 Image Recording
    5. 2.2.5 Underwater Locator Beacons – Bracket Attachments
  4. 2.3 Material Susceptibility to Fire – Certification Standards
    1. 2.3.1 Flammability of Materials
    2. 2.3.2 Contamination Issuess
    3. 2.3.3 Non-fire-bardened Aircraft Systems
  5. 2.4 Aircraft Fire Detection and Suppression
  6. 2.5 In-Flight Firefighting Measures
  7. 2.6 Crew Preparation and Training
    1. 2.6.1 In-Flight Firefighting
    2. 2.6.2 In-Flight Emergency Diversions
  8. 2.7 Checklist Issues
    1. 2.7.1 Swissair Checklist Options for Smoke Isolation
    2. 2.7.2 Emergency Electrical Load-Shedding
    3. 2.7.3 Additional Checklist Issues
    4. 2.7.4 Checklist Revisions and Approvals
  9. 2.8 Maintenance and Quality Assurance Aspects
  10. 2.9 Potential Effect of High-Intensity Radiated Fields
  11. 2.10 Air Traffic Services Issues
  12. 2.11 ACARS and VHF Communications Gap Anomalies
  13. 2.12 Flight Crew Reading Light (Map Light) Installation
  14. 2.13 Circuit Breaker and Electrical Wire Issues
    1. 2.13.1 Circuit Breaker Technology
    2. 2.13.2 Circuit Breaker Reset Philosophy
    3. 2.13.3 Circuit Breaker Maintenance
      2.13.4 Electrical Wire Separation Issues
  15. 2.14 In-Flight Entertainment Network
    1. 2.14.1 Operational Impact of the IFEN Integration
    2. 2.14.2 FAA Oversight (Surveillance) of the IFEN STC Project
    3. 2.14.3 IFEN System Design and Analysis Requirements
    4. 2.14.4 FAA Aircraft Evaluation Group Role/STC Involvement
    5. 2.14.5 IFEN STC Project Management
  16. 2.15 Factors Influencing Pilot Decision Making Regarding Initial Odour and Smoke
  17. 2.16 Factors Influencing Pilot Decision Making during Diversion
  18. 2.17 Fire Development
    1. 2.17.1 Potential Ignition Sources – General
    2. 2.17.2 Arc-Damaged Cables and Wires
    3. 2.17.3 Airflow, Fire Propagation, and Potential Ignitioin Locations
    4. 2.17.4 Fire Propagation from an Arc Fault Near STA 383
  19. 2.18 Known Technical Failure Events
  20. 2.19 Remaining Few Minutes Following Stoppage of Recorders
  21. 2.20 Actual Versus Theoretical Emergency Descent Profile
    1. 2.20.1 General
    2. 2.20.2 Earliest Possible Landing Time
    3. 2.20.3 Effect of Fire-Related Failures on Landing
    4. 2.20.4 Theoretical Emergency Descent Calculations
  22. 2.21 Fire Initiation

3.0 Conclusions

  1. 3.0 Conclusions
  2. 3.1 Findings as to Causes and Contributing Factors
  3. 3.2 Findings as to Risk
  4. 3.3 Other Findings

4.0 Safety Action

  1. 4.0 Safety Action
  2. 4.1 Action Taken
    1. 4.1.1 MD-11 Wiring
    2. 4.1.2 Flight Recorder Duration and Power Supply
    3. 4.1.3 Thermal Acoustic Insulation Materials
    4. 4.1.4 MD-11 Flight Crew Reading Light (Map Light)
    5. 4.1.5 In-Flight Firefighting
    6. 4.1.6 Overhead Aisle and Emergency Lights
    7. 4.1.7 In-Flight Entertainment Network/Supplemental Type Certificate
    8. 4.1.8 Circuit Breaker Reset Philosophy
    9. 4.1.9 Standby Instrumentation
    10. 4.1.10 Material Flammability Standards
    11. 4.1.11 Air Traffic Controller Training
  3. 4.2 Action Required
    1. 4.2.1 Thermal Acoustic Insulation Materials
    2. 4.2.2 Interpretation of Material Flammability Test Requirements
    3. 4.2.3 IFEN – Supplemental Type Certificate Process
    4. 4.2.4 Circuit Breaker Reset Philosophy
    5. 4.2.5 Accident Investigation Issues
  4. 4.3 Safety Concern
    1. 4.3.1 In-Flight Firefighting Measures
    2. 4.3.2 Aircraft System Evaluation: Fire-Hardening Consideration
    3. 4.3.3 Aircraft Wiring Issues
    4. 4.3.4 Flight Crew Reading Light (Map Light)
    5. 4.3.5 Standby Instrumentation
    6. 4.3.6 Contamination Effects
    7. 4.3.7 Arc-Fault Circuit Breaker Certification
    8. 4.3.8 Role of the FAA's Aircraft Evaluation Group
    9. 4.3.9 Checklist Modifications
    10. 4.3.10 Accident Investigation Issues

5.0 Appendices

  1. 5.0 Appendices
  2. Appendix A – Flight Profile: Selected Events
  3. Appendix B – Swissair Air Conditioning Smoke Checklist
  4. Appendix C – Swissair Smoke/Fumes of Unknown Origin Checklist
  5. Appendix D – Timeline

List of Figures

  1. List of Figures
Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

Fire

  1. Summary of Heat Damage
    1. Conditioned Air Ducts
      1. Conditioned Air to the Cockpit
      2. Conditioned Air to the Passenger Cabin
    2. Recirculation Air System Fans and Ducts
    3. Cockpit Headset
    4. Cockpit Carpet and Seats
    5. Cockpit Wall Panels, Door, and Door Jamb
    6. Areas of Re-solidified Aluminum
    7. Lavatories
    8. Smoke Detectors
    9. Galley System
    10. Cabin and Emergency Lights
    11. Avionics CB Panel
    12. Overhead Panel
  2. Smoke in the Cockpit Study
  3. Burn Tests
    1. Small-Scale Burn Tests
    2. Hollow Tube "Jellyroll" Burn Test
    3. Electrical Wire Arc Tests
    4. MPET-Covered Insulation with Splicing Tape and Hook-and-Loop Fastener
    5. Silicone Elastomeric End Cap
    6. Cone and Micro-calorimeter Tests
    7. Intermediate Scale Burn Test
      1. Test Method
      2. Test Procedure
    8. Full-Scale Burn Tests
      1. Test Method
      2. Test Procedure

Summary of Heat Damage

Conditioned Air Ducts

Conditioned Air to the Cockpit

Conditioned air was delivered to the cockpit through a vertical riser duct installed on the left side of the aircraft, outboard of Galley 1, at approximately STA 390. The riser duct split into two smaller distribution ducts, at a wye connection, near the top of Galley 1. At the time that the aircraft was constructed, no insulation was installed on the outer surface of the riser duct below this wye; however, insulation with an MPVF cover material was installed around the two smaller distribution ducts above the wye. Both of the smaller ducts continued horizontally forward above the cockpit door header, through the smoke barrier to the cockpit diffuser manifolds. The first manifold supplied conditioned air to the three overhead diffusers; the second manifold supplied conditioned air to the three window diffusers, located above the cockpit window frames, and to the pilot and co-pilot individual air outlets. The cockpit riser duct was fabricated from 6061 aluminum alloy.

The majority of the cockpit riser duct from the top of Galley 1 down to the floor was reconstructed and these pieces did not exhibit any heat or soot damage.

(See photograph of "Cockpit riser duct.")

The small distribution duct for the cockpit overhead diffusers exhibited discolouration of the FR primer paint, beginning above the wye at STA 399, Z= 64. A portion of this duct, located near the cockpit door header at STA 396, X= 19 and Z= 72, exhibited a number of deposits on the outer surface. Recovered portions of both small distribution ducts exhibited severe heat damage from STA 399 to STA 350, bound laterally (with one exception)[1] by the plane 15 left and right intercostals.

(See photograph of "Overhead diffuser manifold.")

The deposits were analyzed and determined to be resolidified aluminum; the precise alloy was not determined. There was no heat damage on the window diffusers, but each diffuser exhibited a light soot accumulation.

Conditioned Air to the Passenger Cabin

Conditioned air was delivered to the passenger cabin through four main distribution ducts: one duct on the left side of the aircraft and three ducts on the right side. The main distribution ducts supplied conditioned air to smaller individual air ducts. The left-side distribution duct comprised a fibreglass riser duct (PN ABM7623-1) and a rigid foam duct (PN ABM7536-1). The fibreglass riser duct was installed outboard of Galley 1 and extended vertically from below the floor to above the Galley 1 ceiling, running diagonally across the Galley 1 ceiling to terminate slightly aft of the rear inboard corner of Galley 1. The riser duct was wrapped in a single layer of MPVF-covered insulation blanket. The fibreglass riser duct connected with the rigid foam duct segment above the cabin ceiling, slightly aft and inboard of Galley 1 (STA 420, X= 28). The rigid foam duct segment ran horizontally aft from STA 420 to STA 478. The rigid foam duct was not insulated.

(See photograph of "Rigid foam duct.")

A small portion of the fibreglass riser duct, located near the cabin floor level, was identified and exhibited no heat or soot accumulation. None of the rigid foam duct segment was identified.

The riser assembly, consisting of three ducts, on the right side of the aircraft was installed outboard of Galley 2 and extended vertically from below the floor to above the Galley 2 ceiling. The riser duct assembly connected to a horizontal three-duct segment which extended aft, just above the forward cabin drop ceiling, from Galley 2 to STA 480. An insulation blanket with an MPET cover material was wrapped around the riser duct assembly. Inboard of the splice joint, the horizontal three-duct assembly had duct insulation with MPVF cover material. A separate insulation blanket with MPET cover material was installed around the joints between the duct assemblies, located between STA 392 and STA 427. Another insulation blanket with an MPET-type cover material was installed around the STA 480 joints at the aft end of the horizontal three-duct assembly.

The lower surface of the three-duct riser assembly exhibited a region of severe heat damage from X= –30 inboard to the joint at X= –20. The upper surface of this same assembly had areas of no heat damage.

A segment of duct (PN ABM7181-221), measuring 8.9 cm (3.5 inches) in diameter and 5.1 cm (2 inches) in length, branched off from the horizontal three-duct assembly and terminated at STA 407, X= 13, Z= 76. A silicone elastomeric end cap (PN 9D0068-0350) was installed over the end of this branch duct and held in place by an adjustable clamp. The end cap was covered with an MPVF-type cover material.[2] The branch duct and a large piece of the conditioned air duct to which it mates were recovered from the wreckage and reconstructed.

(See photograph of "Branch and conditioned air ducts.")

Both ducts exhibited severe heat damage consistent with damage seen on temperature reference coupons that were exposed to temperatures from 427 to 621°C (800 to 1 150°F) for 10 minutes; however, heat damage of this type could also be generated at higher temperatures over a shorter time interval.

Recovered portions of the horizontal three-duct segment exhibited areas of severe heat damage on the upper surfaces in the vicinity of the Galley 2 vent duct. This high heat area[3] extended longitudinally from approximately STA 395 to STA 442 and laterally from X= 25 to X= –10. The lower surface of the same three-duct segment exhibited areas of undamaged FR primer from STA 408 to STA 442, X= 20 to X= –3. The upper surface of the centre duct in the segment exhibited an area of undamaged FR primer from STA 408 to STA 418, X= –10 to X= –17. The remainder of the horizontal three-duct segment between STA 442 and STA 480 was not recovered. A coated fibreglass cloth duct splice (PN IT-5043-162) was recovered and exhibited impact and localized heat and soot damage. The two possible locations for this duct splice were on the centre duct of the horizontal three-duct segment at approximately STA 401, X= –45 or STA 475, X= 5.

The passenger cabin conditioned air distribution ducts continued aft from STA 480 as four separate ducts. Between STA 480 and STA 520, the distribution ducts angled upward to run along the upper crown area. At STA 555, the forward end of the recirculation air duct joined the distribution duct for the forward cabin zone. The remaining three distribution ducts continued aft along the upper crown.

Recovered portions of the cabin conditioned air distribution ducts between STA 480 and STA 545 were characterized by undamaged FR primer on the lower surfaces of the ducts and a few small areas of severe heat damage on the upper surfaces of the ducts. This is the area in which the ducts transitioned from the forward cabin drop-ceiling structure upward to the crown.

(See photograph of "Cabin conditioned air distribution ducts.")

The remaining cabin conditioned air distribution duct from STA 555 aft, including the muffler assembly at approximately STA 585, did not exhibit heat damage to the FR primer. The recovered portions of the two individual air ducts from approximately STA 555 to STA 595 at X= 70 and X= –70 did not exhibit heat damage to the FR primer but exhibited areas of light to moderate soot accumulation.

Recirculation Air System Fans and Ducts

Recirculation air was supplied by four fans located above the passenger compartment ceiling at STA 685, STA 725, STA 1009, and STA 1109, each at lateral position X= 28. Each fan drew air through a filter and plenum assembly located at the corresponding station from X= 40 to X= 65. The plenum assemblies were reconstructed; the plenums that had been installed at STA 685 and STA 725 exhibited no discolouration of the FR primer on the aluminum parts but exhibited localized areas of heavy soot accumulation. The recovered portions of the fibreglass filter elements exhibited dark grey colouration on one side and light grey colouration on the opposite side. The hoses connecting these plenum assemblies to the fan housings exhibited localized, light soot accumulation on the outer surfaces but exhibited no soot accumulation on the interior surfaces. The recovered portions of the plenums from STA 1009 and STA 1109 did not exhibit heat damage or soot accumulation.

The recirculation duct was uninsulated between STA 569 and the recirculation fan at STA 685. A check valve was installed in the duct to prevent reverse airflow when the fan was not operating. Portions of the recirculation duct between STA 685 and STA 555, where it joins the cabin conditioned air duct, were recovered. The recovered pieces of recirculation duct exhibited severe heat damage on the uninsulated sections aft of STA 569.

Centre forward cabin individual air was supplied from the cabin recirculation air distribution duct at two locations: STA 575, X= 27 to STA 584, X= 2 and at STA 692, X= 20 to X= 9. Recovered portions of the duct from both of these locations exhibited severe heat damage.

Forward cabin individual air was supplied by a fan and plenum assembly that was identical to the recirculation air. The fan was located at STA 990, X= –24 and the plenum assembly was located between X= –40 and X= –65. The recovered portions of the plenum did not exhibit heat damage or soot accumulation. The individual air ducts were uninsulated and ran forward from STA 990 to a wye at STA 750, Z= 91, X= –21. One branch of the wye ran across the crown to the left side of the cabin (X= 76) and the other branch ran to the right side (X= –76). The recovered portions of these ducts exhibited moderate to heavy soot accumulations with no heat damage. The aft-most segment of individual air duct that was recovered was from STA 934 to STA 955 at X= –22; the duct segment exhibited light soot accumulation.

Cockpit Headset

A melted portion of an ear piece from the boom microphone side of a cockpit headset was recovered. The ear piece was fabricated from a black polymer compound with a melting temperature of approximately 177°C (350°F). It could not be determined where the headset was located when the fire was in progress, although it was likely in the cockpit.

Cockpit Carpet and Seats

Recovered portions of the cockpit carpet included numerous areas with localized heat damage. The carpet exhibited an irregular, indented, spotted appearance at locations where the pile had been reduced to short stubble. Microscopic fibre analysis determined that the spotted areas had been produced by high-temperature material that had dropped onto the carpet from above. The carpet was fabricated from 100% wool. The wool fibre ends exhibited discolouration and bubbling indicative of burned wool hairs. No traces of the drop-down material were recovered. The brittle, burned fibre ends had broken off, most likely during impact, releasing the material that had fallen and adhered to the carpet fibre and leaving the short stubble patterns on the carpet. It was determined that the majority of the fibre drop-down damage was likely the result of the cockpit ceiling liner melting and dripping onto the carpet.

(See photographs of "Left cockpit ceiling liner - inboard face," "Left cockpit ceiling liner - outboard face," "Right cockpit ceiling liner - outboard face," and "Right aft overhead cockpit ceiling liner - outboard face.")

Several deposits were found on the right observer's seat. A small amount of resolidified 2024 aluminum alloy was deposited on the lap belt and on the right side of the seat base on a screw.

A small amount of resolidified 6061 aluminum alloy was found on the rear of the seat base on a CB.

(See photograph of "Right observer's seat.")

When the resolidified aluminum was removed from the lap belt, a white deposit remained. Other white deposits were observed elsewhere on the same lap belt. Trace analysis of these white deposits identified their composition as being primarily aluminum oxide. Microscopic fibre analysis identified fused, heat-damaged lap belt material at each location where the aluminum oxide deposits were found. These other white deposits were determined to be from locations where molten aluminum had once been deposited. The precise alloy of the aluminum from these latter locations could not be determined. It cannot be determined at what point during the flight sequence, impact sequence, or both that these deposits were made.

Cockpit Wall Panels, Door, and Door Jamb

The left and right rear cockpit wall panels, door, and portions of the door jamb were made from para-aramid fibre. The complete left rear wall panel was recovered. The forward-facing surface of this panel exhibited localized heavy soot accumulations on the top 46 cm (18 inches). The aft-facing surface of this panel exhibited no evidence of heat or soot damage. The complete right rear wall panel, which had been attached to Galley 2, was recovered. No evidence of soot was found on this panel, but localized black drips were found on the forward-facing surface of the panel. The majority of the drips were located between 28 and 79 cm (11 to 31 inches) from the top of the panel.

The cockpit door was located between the left and right cockpit rear wall panels. The main door panel comprised a para-aramid fibre panel with a honeycomb core, covered on both sides with resin impregnated glass fibre fabric facing. A decorative laminate was bonded to the forward-facing surface of the door. The lower portion of the door had a rectangular hole, measuring 81 x 41 cm (32 x 17 inches), to accommodate a louvred panel grill assembly (blow-out panel). The blow-out panel consisted of a forward and aft para-aramid fibre grill panel separated by polyurethane foam blocking and was enclosed in an aluminum frame. An aluminum cover was bonded to each of the para-aramid fibre grill panels; the exposed aluminum surfaces were covered with a decorative laminate. A clear, plastic, rectangular certificate holder, measuring 34 x 25 cm (13 x 10 inches) was mounted on the forward-facing surface of the cockpit door and centred approximately 69 cm (27 inches) down from the top of the door.

The main door panel was recovered. Small portions of the decorative laminate remained bonded to the forward-facing surface of the para-aramid fibre panel. A dark discolouration was evident on the upper third of the forward-facing surface of the door on both the exposed para-aramid fibre panel and the remnants of the decorative laminate.

Portions of the blow-out panel were recovered. The aluminum covering had separated from both the forward and aft para-aramid fibre grill panels; however, pieces of aluminum were identified as having been installed on the para-aramid fibre door grill panels. There was no evidence of heat damage or soot accumulations on the forward or aft para-aramid fibre grill panels or the aluminum covering. The certificate holder was recovered. The holder was deformed between the two vertical sides. An area of black discolouration, measuring 2.5 cm (1 inch) wide and 3.8 cm (1.5 inches) high, was observed near the lower right corner of the holder; the top edge of the certificate holder exhibited slight, melt-like characteristics.

(See photograph of "Aircraft certificate holder.")

Portions of the door jamb were recovered. The inner surface of the door jamb structure exhibited an area of heavy, soot-like discolouration located between 156 and 174 cm (64 to 68.5 inches) above the cockpit floor. This soot-like discolouration gradually diminished to a faint soot-like discolouration about 123 cm (48.5 inches) above the cockpit floor. Two portions of the left side door jamb were identified. Both portions, one identified as having been located between approximately 133 and 214 cm (52.5 to 84.5 inches) and the other between 199 and 214 cm (78.5 to 84.5 inches) above the cockpit floor, exhibited localized areas of moderate to heavy soot accumulation and evidence of heat damage.

The angle assembly installed across the top of the door jamb was identified. The angle assembly exhibited evidence of heat damage, including blistering and missing or discoloured paint.

A portion of the door frame fairing assembly, measuring approximately 24 cm (9.5 inches) wide, was identified as having been located between 150 and 197 cm (59 to 77 inches) above the cockpit floor level. The inner-facing surface of the upper end of the fairing exhibited discolouration that corresponded to oven test samples exposed to approximately 260°C (500°F) for 10 minutes. In addition, the grey finish canvas on the outer-facing surface, which was exposed to the cockpit, exhibited localized heat damage and soot accumulations.

Areas of Resolidified Aluminum

Several resolidified aluminum deposits were found on the outer surface of the cockpit conditioned air duct, at a position just aft of the smoke barrier. The precise alloy of this aluminum could not be determined by energy dispersive x-ray spectrography. Deposits of 6061 and 2024 aluminum alloy were identified on the top of the emergency lighting system battery pack, which was installed on top of the forward cabin drop-ceiling panel that was located immediately aft of the cockpit door.

(See photograph of "Top of emergency light battery pack.")

Lavatories

Nine lavatories were installed in the aircraft. The tops of Lavatory A and Lavatory B were exposed to the area in which the fire occurred. Parts recovered from the remaining seven lavatories did not exhibit heat damage or soot accumulations.

Smoke Detectors

A smoke detector control panel with short lengths of nine wires protruding through the cover was recovered and identified as the Lavatory A and Lavatory B smoke detector control panel. This panel was installed in the left forward cabin drop-ceiling area, adjacent to the inboard aft corner of Galley 1. Soot accumulations were found on the outer insulation of the nine wire segments. The outer surface of the panel cover exhibited heavy soot accumulations; however, the inner surface of the cover was free of soot. There was no evidence of heat damage or soot accumulation on the wiring and printed circuit boards inside the panel. A partially melted nylon wire support remained attached to the exterior of the panel.

Galley System

Twelve galley units were installed in the aircraft. Galleys 1, 2, and 3 were located forward of the first-class cabin; the upper surfaces of these galleys were exposed to the area in which the fire occurred, through a cut-out in the ceiling panels.[4] The galley structures were fabricated from meta-aramid fibre paper panels with fibreglass cover plates and extrusions bonded or rivetted to the panels. The top surface of the galleys was exposed to the area above the forward cabin drop-ceiling through a cut-out in the ceiling panels. The gaps between the galleys and the ceiling panels were filled with a foam material.

Galley 1 was installed on the left side of the forward cabin between the cockpit aft wall and the left forward cabin door. A large section, consisting of a number of portions of the upper surface of Galley 1 was identified. The upper surface of Galley 1 was horizontal across the top and curved along the left side to follow the contour of the fuselage. The upper surface of these portions, which had been exposed to the area in which the fire occurred, exhibited heavy soot accumulations and thermal discolouring of the paint on the upper surface. A support tube and mounting bracket attached to the top of the galley also exhibited areas of heavy soot accumulation. Near the aft end of the horizontal portion of the upper surface of Galley 1, there was a diagonal region that was relatively clean and undamaged. This region corresponds to the area located below the fibreglass riser duct (PN ABM7623-1), which may have protected this area during the fire. The soot and heat damage ended abruptly on the curved portion of the upper surface, forming a horizontal line at an elevation corresponding to where the 5.1 cm (2-inch) flexible hose (PN S7929462H-8-136) and the 7.6 cm (3-inch plenum hose (PN S7929462H-12-72) connect to the galley vent duct.

(See photograph of "Galley 1 soot accumulations and thermal discolouring.")

Two electrical connectors from the Galley 3 disconnect assembly were recovered. Both connectors exhibited areas of localized soot accumulation. Six 16 AWG wires and two 20 AWG wires remained in one insert grommet. The outer polyimide insulation on several of these wires exhibited areas of heavy soot accumulation and discolouration. The discolouration of the wire insulation corresponded to a wire test sample that was heated in an oven at approximately 522°C (972°F) for 7.5 minutes.

Cabin and Emergency Lights

Emergency exit signs were installed in the aircraft above the doors and in the drop-ceiling header immediately aft of Lavatory A and Lavatory B. A piece of an exit sign lens from the forward cabin drop-ceiling area was recovered. The lens exhibited heat damage; there was a hole in the lens with melting and wrinkling around the edges of the hole. A piece of gasket-like material remained attached to the edge of the lens; the gasket material exhibited localized areas of dark brown to black discolouration and thermal shrinkage.

Three fluorescent light fixtures were installed in the forward cabin drop-ceiling panels. Two pieces of the fluorescent light lens material were recovered. Both pieces of the lens material exhibited heat damage, including localized thinning of the material accompanied by melt wrinkles and tight folds, thermal discolouration, and soot accumulation.

Light fixtures were installed in the ceiling bridge panels above the aisles in the main cabin to provide aisle lighting and emergency lighting. Each fixture contained two lights: an inboard emergency light and an outboard aisle light. Portions of ceiling bridge panels were recovered with localized, circular, dark discolouration around the cutout for the outboard aisle light. The areas of the ceiling bridge panel adjacent to the inboard emergency light were not heat damaged or discoloured. An exemplar aisle light fixture was removed from an in-service MD-11. This latter assembly exhibited melt-like deformation on the inside surface of the clear lens portion, heat damage to the associated sealant, and an amber discolouration of the clear lens. The lower surface of the lens assembly that faced into the cabin was not discoloured or thermally deformed.

Avionics CB Panel

The avionics CB panel, situated above the work table at the right observer's station, consisted of an upper and lower panel, both of which were fabricated from 0.1 cm (0.05-inch) 6061-T6 sheet aluminum and painted grey on the side that faces into the cockpit. The upper avionics CB panel was installed at an angle to the vertical with the upper edge farther inboard than the lower edge. The lower avionics CB panel was mounted vertically, directly below the upper panel.

The CB terminal from the IFEN DC CB at position F-1 was recovered; the 16 AWG jumper wire was still attached to the terminal and to segments of the DC Bus 2 feed wires. The CB contact was not heat damaged or pitted; the jumper wire was not heat damaged but trace accumulations of soot were present on the wire. The jumper wire remained attached to the bus feed wire that had been installed at positions F-2, F-3, and F-4; the CB terminals from positions F-2 and F-3 remained attached to these wires. There was no indication of heat damage or electrical arcing on the DC bus feed wires or on the F2 and F3 CB terminals; however, trace amounts of soot accumulation were observed on these components.

The high heat damage on the front surface of the panel near the aft end (just forward of STA 383) is not seen at a corresponding location on the back surface. Items adjacent to the back surface in this area are in relatively good condition, such as the recovered pieces of the power wires and portions of the 28 V AC 1 bus bar, the grey sleeving and power wire assembly for 115 V AC Bus 1 associated with bus bar assembly items B7-12 and B7-13.

The back surface of the panel near this location shows little heat damage, as noted above. A fire initiating on the over-frame MPET-covered insulation material would not generate high heat during its incipient stage of growth. High heat would not be expected until the fire had spread elsewhere, and grown in intensity. The heat patterns observed on the upper avionics CB panel and elsewhere in the cockpit are indicative of secondary damage created by the fire much later during the fire sequence.

The high heat damage evident on the front face of the upper avionics CB panel essentially forms the outline of two areas: an irregularly shaped band that is primarily horizontal along the upper edge of the panel and another irregularly shaped region, which is offset at a diagonal angle. The patterns are consistent with secondary fire damage likely produced by the combined effects of the cockpit ceiling liner being breached (between the right overhead diffuser and the upper inboard edge of the avionics CB panel) and the effects of the overhead duct assembly, which is routed to the right cockpit window defroster, acting as a fire barrier.

Failure of the ceiling liner would allow combustion by-products to be drawn into the cockpit by being entrained into the conditioned air stream being blown out of the right overhead diffuser toward the front face of the avionics CB panel. This could cause the high heat damage pattern observed on the front face along the top edge.

The outline of the diagonal heat pattern corresponds with the diagonal path of the right window defroster duct assembly that is routed behind the avionics CB panel. This duct assembly, and a portion of the right cockpit individual air supply assembly, would be expected to act as a diagonal fire barrier dividing the air space behind the panel in two. The high heat damage patterns found on both the front and back sides of the upper avionics CB panel forward of the diagonal, and the high heat damage present on the aircraft frames in this localized area, are consistent with damage generated by high-temperature combustion by-products being directed into this confined region. The lesser degree of heat damage aft of the diagonal duct assembly is consistent with a lower heat build up in that area. This lesser heat damage is likely the result of factors, such as the larger air space volume behind the panel in this region and the air flow being evacuated down the ladder area.

The CBs for the first three FDR recorded events associated with electrical circuit failures are located at the forward end of the avionics CB panel in an area where high-temperature damage is evident. It is significant to note that these events took place approximately 13 minutes after an unusual odour was first detected in the cockpit, which was late in the fire sequence. The timing of these events and the location of the associated CBs are consistent with the report’s description of the fire initiation and growth sequence.

The two 115 V AC Bus 1 power wires for phases B and C, as well as the 115 V AC Bus 1 power wire for phase A, were 8 AWG nickel-coated wires. These wires were wrapped in polyimide tape with an outer aromatic polyimide braid. The wires were placed inside a grey sleeving for a portion of their lengths. The sleeving consisted of a glass fibre braid with a silicone elastomer coating.

Overhead Panel

The overhead panel area is located in the centre cockpit ceiling between the captain's and first officer's seats. The overhead panel contains system control panels in the forward portion, engine fire detection and shutoff in the middle portion, and the overhead CB panel in the aft portion. The cavity behind the overhead panel is contained within a fibreglass housing. The housing contains wiring routed to the control panels, module block strips, and ground studs.

The overhead panel wires enter and leave the housing through one of two oval holes located on the left and right side of the aft wall of the housing. System wires that leave the housing through the left side oval hole are primarily in wire run AML and are routed aft above the cockpit ceiling. The recovered segments of the AML wire run extended up to 76.2 cm (30 inches) aft of the oval hole. System wires that leave the housing through the right side oval hole are primarily in wire run AMK and are routed either aft above the cockpit ceiling or outboard of the avionics CB panel. The recovered segments of the AMK wire run extended up to 8.5 inches aft of the oval hole. The overhead CB panel bus feed wires also exited through the right side oval hole. These wires were routed aft along the left side of the CB panel, across the aft end of the CB panel, and through the right side oval hole in the aft end of the housing. Recovered segments of the overhead CB panel bus feed wires extended up to 25 inches aft of the right housing oval hole.

The overhead CB panel was approximately rectangular. The lower (cockpit-facing) side of the panel was painted grey; the upper surface of the panel was not painted. There were seven rows of CBs on the panel, labelled alphabetically from A to G, with "A" representing the rear-most (aft) row. CBs in each row were numbered sequentially from left to right. A lighted plate assembly was installed above each row of CBs.

Approximately 90% of the overhead CB panel was recovered. The grey paint and primer on the cockpit-facing surface of the panel was missing from an area measuring 4 square inches on the aft right corner of the panel. The bare aluminum corresponded to an oven test sample temperature of 427°C (800°F) (or greater) for 10 minutes. The paint and primer forward of this area was discoloured. This discolouration corresponded to an oven test sample that was exposed to 353°C (650°F) for 10 minutes. Heavy black soot accumulations surrounded the areas of bare metal and discoloured paint. This black soot accumulation continued forward along the side of the panel to the bottom of the Row C light plate. The grey paint on the remainder of the cockpit-facing surface of the panel was not discoloured. The upper surface of the panel that faced into the overhead housing was not painted; however, a heat pattern was visible on the upper surface on the aft right corner of the panel. The polycarbonate base for a light plate assembly was recovered with the aft panel portion. The Row A light plate base exhibited extensive melting and thermal deformation; some CB buttons and springs were entrapped in the melted area. Light plate assemblies corresponding to rows located farther forward in the overhead CB panel exhibited progressively less thermal damage.

A segment of wire harness from the CVR control panel was recovered. A two-conductor shielded wire and a 24 AWG wire exhibited black discolouration on the polyimide insulating film; the copper conductor was not embrittled or melted. The black discolouration of the polyimide film was consistent with damage to an oven sample that was exposed to approximately 510°C (950°F) for 7.5 minutes. The area of heat damage was approximately 6 cm (2.5 inches) forward to 13 cm (5 inches) aft of the oval hole on the right side in the aft end of the housing assembly. Additional wire harnesses and components from the overhead panel were recovered and analyzed. This analysis resulted in numerous and consistent indications of temperatures exceeding 482°C (900°F) for several minutes in the area of the right oval hole in the aft wall of the housing. The region of high temperature extended aft for several inches from the right oval hole in the housing.

Smoke in the Cockpit Study

In December 1998, the FAA Safety Analysis Branch reviewed all airline incidents investigated by the NTSB and 475 000 SDRs from 1986 to September 1998. The review identified 2 514 SDRs and 10 NTSB incident reports that were considered to be representative of incidents of smoke in the cockpit. The reports addressed the entire USA fleet of air transport category aircraft and the majority of regional aircraft with 20 seats or more. A review of the FAA study conducted on USA airline aircraft revealed the following points with respect to "smoke in the cockpit" events:

  • In one third of the reports, there was no smoke at all; these events were caused by faulty smoke detectors, burning oil stains from earlier maintenance and most commonly, from foul-smelling air conditioning bags that flight crew members interpreted as smoke.
  • Air conditioning systems were the most common source of reported incidents, accounting for 36.7% of the reports; in most cases, there was no smoke at all. However, these reports resulted in 30 diversions per year and 3 to 4 evacuations per year.
  • Interior lighting accounted for 14% of the reports. These reports resulted in four diversions per year and no evacuations.
  • Anti-ice and heating systems for windows and doors accounted for 9.7% of the reports.
  • Electric power systems, including APUs, accounted for 8.5% of the reports.
  • Navigation systems, such as on-board computers, altimeter encoders, and weather radar systems accounted for 7.3% of the reports.

These categories of smoke events accounted for 77% of all SDRs involving smoke in the cockpit. From 1994 to September 1998, the average annual US commercial aircraft fleet size was approximately 6 110 aircraft. During this time period, there were approximately 256 reports per year of smoke in the cockpit, 30 of which resulted in a diversion. These figures equate to one smoke in the cockpit event for every 24 aircraft per year and 1 diversion for every 203 aircraft per year. If aircraft were diverted for every smoke in the cockpit event, this would result in 256 diversions per year for 6 110 aircraft or one diversion per 24 aircraft per year. As the world fleet comprises approximately 18 000 aircraft, assuming the same diversion ratio for the world fleet as for the US fleet, this ratio would mean 754 diversions worldwide per year.

Burn Tests

Small-Scale Burn Tests

In the MD-11, thermal acoustic insulation blankets were installed with hook-and-loop fasteners. The seams between adjoining blankets were sealed with MPET-type 5 splicing tape constructed with MPET or MPVF material and coated with adhesive. Small-scale burn tests were conducted to determine the flammability characteristics of MPET-covered insulation blankets, hook-and-loop fasteners, and adhesive tape. Additional tests were conducted to determine the ignition and flame propagation characteristics of these and other aircraft materials.

Hollow Tube "Jellyroll" Burn Test

Preliminary attempts were made to ignite MPET-covered insulation blankets with a Bunsen burner as an ignition source. It was observed that the outer film would shrink away from the ignition source, allowing the film to self-extinguish. However, if the insulation material was formed into a jellyroll shape with a hollow centre, and a small pilot flame was introduced within the tube, the film material would ignite and propagate consistently over the inner surface of the tube. Much of the film covering the outer surface of the tube was also consumed.

This configuration enabled the cover film on the inside radius of the jellyroll to be significantly pre-heated, which was observed to be an important factor affecting the fire behaviour of the cover material. There were significant changes in the burn rate, heat release rate, and propensity to self-extinguish. The material was less inclined to self-extinguish. Although MPET-covered insulation blankets were generally easier to burn than the MPVF-covered insulation blankets, the flammability of both types of cover material increased when the material was pre-heated.

(See video of "Hollow tube burn test.")

Electrical Wire Arc Tests

A review of the relevant literature indicated that AES may be used to differentiate between an arc that initiated a fire (arcing in a clean environment) and one that resulted from a fire (arcing in a contaminated or smoky environment). The TSB investigated whether it was possible to make this determination with some degree of accuracy. As the literature referred only to copper melts generated by arcs using household types of wire insulation, the TSB initiated a study using aircraft type wire insulations.

The primary aircraft wire insulation used in the MD-11 was MIL-W-81381, a polyimide-wrapped, nickel-coated copper conductor. The primary insulation material used on the IFEN system power wiring was an ETFE, tin-coated copper conductor. As some segments of each of these two types of insulated wires were recovered with copper melt damage, the study focused on these two types of wire insulation.

To provide copper melts and beads for the AES study, TSB investigators created a number of arcing events, under controlled conditions, at the Boeing Electrical Laboratory in Seattle. The copper melts were generated by first breaching the insulation and then using either an aluminum bar (to simulate aircraft structure) or an uncoated copper drag wire to short circuit the wires. Other arcs were created by exposing the insulated conductors to burning aircraft materials and then applying a direct flame source, using a Bunsen burner, to simulate arcs created in a fire environment. Various combinations of the insulation types were used to generate copper melts with each type of insulation using both 115 V AC 400 Hz and 28 V DC power sources. A sampling of these copper melts was then provided for AES examination in a blind study (i.e., the origin of the copper melt was not disclosed until after the study was complete).

(See videos of "Electrical wire arc tests - polyimide insulation" and "Electrical wire arc tests - ETFE insulation.")

MPET-Covered Insulation with Splicing Tape and
Hook-and-Loop Fastener

A piece of MPET-covered thermal acoustic insulation blanket material was selected from MPET Lot Number 2007 (Exhibit 1-14672). This piece was chosen because it had an area of cover material that had MPET and MPVF-covered tape adhered to it. A strip of hook-and-loop fasteners was in contact with cover material on one side and in contact with MPET-covered tape on the other side. The piece was laid on top of a piece of yellow fibreglass batting that came from an insulation blanket from the same lot number.

On 7 December 2001, the cover material was ignited using a small flame from a butane lighter at a corner of the specimen. A small, creeping fire (with a flame height measuring approximately 1 to 2.5 cm (0.5 to 1 inch)) was observed to burn across the specimen. The flame front came in contact with MPET-covered tape at a number of different locations. In every case, the flame front ignited the MPET-covered tape, the flame front noticeably increased in size (with the flame height sometimes reaching 17.5 cm (7 inches)) and the flame spread rate slowed. The burning cover material produced a significant amount of smoke; however, the MPET-covered tape produced much more smoke and burned with greater intensity and duration than the cover material alone. The flame front came in contact with MPVF-covered tape at two locations. In both cases, the MPVF-covered tape ignited with no apparent difficulty. The flame size increased slightly and the flame-spread Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003

Transportation Safety Board of Canada
Symbol of the Government of Canada
Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

1.0  Factual Information

The investigation of the Swissair Flight 111 (SR 111) occurrence was complex and involved detailed examination of many operational and technical issues. The information in Part 1 of the report is organized into the subject areas specified by the International Civil Aviation Organization investigation report format. While the investigation uncovered many facts with respect to the flight, the aircraft, maintenance, personnel, and so on, only factual information that is pertinent to understanding the SR 111 occurrence is provided in this part along with some preliminary evaluation (first-stage analysis) that serves as a basis for the Analysis, Conclusions, and Safety Action parts of the report.

  1. 1.1 - History of the Flight
  2. 1.2 - Injuries to Persons
  3. 1.3 - Damage to Aircraft
  4. 1.4 - Other Damage
  5. 1.5 - Personnel Information
  6. 1.6 - Aircraft Information
  7. 1.7 - Meteorological Information
  8. 1.8 - Aids to Navigation
  9. 1.9 - Communications
  10. 1.10 - Aerodrome Information
  11. 1.11 - Flight Recorders
  12. 1.12 - Wreckage and Impact Information
  13. 1.13 - Medical Information
  14. 1.14 - Fire
  15. 1.15 - Survival Aspects
  16. 1.16 - Tests and Research
  17. 1.17 - Organizational and Management Information
  18. 1.18 - Other Relevant Information
  19. 1.19 - Useful or Effective Investigation Techniques

Next

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

1.1  History of the Flight

This section summarizes, in chronological order according to Coordinated Universal Time (UTC),[1] the main events that occurred during the flight and that are directly related to the SR 111 occurrence ending with the aircraft's impact with the water near Peggy's Cove, Nova Scotia, Canada. Refer to Appendix A – Flight Profile: Selected Events for a graphical representation of the flight path of the aircraft.

At 0018 UTC (2018 eastern daylight savings time) on 2 September 1998, the McDonnell Douglas[2] (MD) MD-11, operating as SR 111, departed John F. Kennedy (JFK) International Airport in Jamaica, New York, United States of America (USA), on a flight to Geneva, Switzerland. Two pilots, 12 flight attendants, and 215 passengers were on board. The first officer was the pilot flying. At 0058, SR 111 contacted Moncton Air Traffic Services (ATS) Area Control Centre (ACC) and reported that they were at flight level (FL) 330.[3]

At 0110:38, the pilots detected an unusual odour in the cockpit and began to investigate. They determined that some smoke was present in the cockpit, but not in the passenger cabin. They assessed that the odour and smoke were related to the air conditioning system. At 0114:15, SR 111 made a Pan Pan[4] radio transmission to Moncton ACC. The aircraft was about 66 nautical miles (nm) southwest of Halifax International Airport, Nova Scotia. The pilots reported that there was smoke in the cockpit and requested an immediate return to a convenient place. The pilots named Boston, Massachusetts, which was about 300 nm behind them. The Moncton ACC controller immediately cleared SR 111 to turn right toward Boston and to descend to FL310. At 0115:06, the controller asked SR 111 whether they preferred to go to Halifax, Nova Scotia. The pilots expressed a preference for Halifax, which was considerably closer. They immediately received an ATS clearance to fly directly to Halifax, which was by then about 56 nm to the northeast. At this time, the pilots donned their oxygen masks.

At 0116:34, the controller cleared SR 111 to descend to 10 000 feet above sea level,[5] and asked for the number of passengers and amount of fuel on board. The pilots asked the controller to stand by for that information. At 0118:17, the controller instructed SR 111 to contact Moncton ACC on radio frequency (RF) 119.2 megahertz (MHz). SR 111 immediately made contact with Moncton ACC on 119.2 MHz and stated that the aircraft was descending out of FL254 on a heading of 050 degrees[6] on course to Halifax. The controller cleared SR 111 to 3 000 feet. The pilots requested an intermediate altitude of 8 000 feet until the cabin was ready for landing.

At 0119:28, the controller instructed SR 111 to turn left to a heading of 030 for a landing on Runway 06 at the Halifax International Airport, and advised that the aircraft was 30 nm from the runway threshold. The aircraft was descending through approximately FL210 and the pilots indicated that they needed more than 30 nm. The controller instructed SR 111 to turn to a heading of 360 to provide more track distance for the aircraft to lose altitude. At 0120:48, the flight crew discussed internally the dumping of fuel based on the aircraft's gross weight, and on their perception of the cues regarding the aircraft condition, and agreed to dump fuel. At 0121:20, the controller made a second request for the number of persons and amount of fuel on board. SR 111 did not relay the number of persons on board, but indicated that the aircraft had 230 tonnes (t) of fuel on board (this was actually the current weight of the aircraft, not the amount of fuel) and specified the need to dump some fuel prior to landing.

At 0121:38, the controller asked the pilots whether they would be able to turn to the south to dump fuel, or whether they wished to stay closer to the airport. Upon receiving confirmation from the pilots that a turn to the south was acceptable, the controller instructed SR 111 to turn left to a heading of 200, and asked the pilots to advise when they were ready to dump fuel. The controller indicated that SR 111 had 10 nm to go before it would be off the coast, and that the aircraft was still within 25 nm of the Halifax airport. The pilots indicated that they were turning and that they were descending to 10 000 feet for the fuel dumping.

At 0122:33, the controller heard, but did not understand, a radio transmission from SR 111 that was spoken in Swiss–German, and asked SR 111 to repeat the transmission. The pilots indicated that the radio transmission was meant to be an internal communication only; the transmission had referred to the Air Conditioning Smoke checklist (see Appendix B – Swissair Air Conditioning Smoke Checklist).

At 0123:30, the controller instructed SR 111 to turn the aircraft farther left to a heading of 180, and informed the pilots that they would be off the coast in about 15 nm.[7] The pilots acknowledged the new heading and advised that the aircraft was level at 10 000 feet.

At 0123:53, the controller notified SR 111 that the aircraft would be remaining within about 35 to 40 nm of the airport in case they needed to get to the airport in a hurry. The pilots indicated that this was fine and asked to be notified when they could start dumping fuel. Twenty seconds later, the pilots notified the controller that they had to fly the aircraft manually and asked for a clearance to fly between 11 000 and 9 000 feet. The controller notified SR 111 that they were cleared to fly at any altitude between 5 000 and 12 000 feet.

At 0124:42, both pilots almost simultaneously declared an emergency on frequency 119.2 MHz; the controller acknowledged this transmission. At 0124:53, SR 111 indicated that they were starting to dump fuel and that they had to land immediately. The controller indicated that he would get back to them in just a couple of miles. SR 111 acknowledged this transmission.

At 0125:02, SR 111 again declared an emergency, which the controller acknowledged. At 0125:16, the controller cleared SR 111 to dump fuel; there was no response from the pilots. At 0125:40, the controller repeated the clearance. There was no further communication between SR 111 and the controller.

At approximately 0130, observers in the area of St. Margaret's Bay, Nova Scotia, saw a large aircraft fly overhead at low altitude and heard the sound of its engines. At about 0131, several observers heard a sound described as a loud clap. Seismographic recorders in Halifax, Nova Scotia, and in Moncton, New Brunswick, recorded a seismic event at 0131:18, which coincides with the time the aircraft struck the water. The aircraft was destroyed by impact forces. There were no survivors.

The accident occurred during the hours of darkness. The centre of the debris field, located on the ocean floor at a depth of about 55 metres (m) (180 feet), was at the approximate coordinates of latitude 44°24'33" North and longitude 063° 58'25" West.

Table 1 conveys the general time frame of the events between the first detection of an unusual odour in the cockpit and the time of impact with the water.

Table 1: Elapsed Time for Key Events

A
A ampere
A&P airframe and powerplant
AAIB Aircraft Accident Investigation Bureau (Swiss)
AC Advisory Circular
AC alternating current
ACARS aircraft communications addressing and reporting system
ACC air conditioning controller
ACC area control centre
ACO Aircraft Certification Office
ACP audio control panel
ACSEP Aircraft Certification Systems Evaluation Program
AD Airworthiness Directive
ADAS auxiliary data acquisition system
ADC air data computer
ADG air-driven generator
ADT Atlantic daylight time
AEG Aircraft Evaluation Group
AEGIS Advanced Electronic Guidance and Instrumentation System
AES airborne earth station (within discussion of ACARS)
AES Auger electron spectroscopy (within discussion of material analysis)
AFCB arc fault circuit breaker
AFF aircraft firefighting
AFM Airplane (or Aircraft) Flight Manual
AFS auto flight system
agl above ground level
Al aluminum
ALAR Approach and Landing Accident Reduction
ALPA Air Line Pilots Association
AMU audio management unit
AND aircraft nose down
ANU aircraft nose up
AOC Air Operator Certificate
AOL All Operator Letter
AOM Aircraft Operations Manual
AP Autopilot
APU auxiliary power unit
ARAC Aviation Rulemaking Advisory Committee
ARINC Aeronautical Radio Inc.
ARP Aerospace Recommended Practice
ARSR air route surveillance radar (USA)
ARTCC Air Route Traffic Control Center (USA)
ASA Aviation Safety Advisory
ASB Alert Service Bulletin
ASC automatic systems control
ASCP air systems control panel
ASDE airport surface detection equipment
ASHRAE American Society of Heating, Refrigeration and Air Conditioning Engineers
ASIL Aviation Safety Information Letter
asl above sea level
ASN assigned serial number
ASR Aviation Safety Recommendation
ASTM American Society for Testing and Materials
ASTRAC Aging Transport Systems Rulemaking Advisory Committee
ATA Air Transport Association
ATC air traffic control
ATIS automatic terminal information service
ATPL airline transport pilot licence
ATS air traffic services
AU avionics upper [panel]
AVI Audio-Video Interleave [Microsoft]
AWG American Wire Gauge
B
BDN broadband distribution network
BEA Bureau d'Enquêtes et d'Analyses pour la Securité de l'Aviation Civile (France)
BIO Bedford Institute of Oceanography
C
14 CFR Title 14, Code of Federal Regulations (USA)
°C degree(s), Celsius
CAA civil aviation authority
CAAC Civil Aviation Administration of China
CAC center accessory compartment
CAD computer-aided design
CAM cockpit area microphone
CANMET Canada Centre for Mineral and Energy Technology
CARAC Canadian Aviation Regulation Advisory Council
CARs Canadian Aviation Regulations
CASS Continuing Analysis and Surveillance System
CAVOK ceiling and visibility OK
CB circuit breaker
CC cluster controller
cc cubic centimetre
CCA circuit card assembly
CCG Canadian Coast Guard
CCGS Canadian Coast Guard Ship
CDR critical design review
CEA Central Engineering Agency
CEM Cabin Emergency Manual
CF Canadian Forces
CFAV Canadian Forces Auxiliary Vessel
CFB Canadian Forces Base
CFD computational fluid dynamics
CFM cubic feet per minute
CFR Code of Federal Regulations (USA)
CFS cabin file server
CHS Canadian Hydrographic Services
cm centimetre
CME Chief Medical Examiner
CMU communications management unit
C of G centre of gravity
COMPT compartment
CPD circuit protection (or protective) device
CPU central processing unit
CRE component responsible engineering
CRES corrosion resistant
CRM cockpit (or crew) resource management
CRP communication radio panel
CSD certification supporting document
CSR Canadian Seabed Research
CSRTG Cabin Safety Research Technical Group
CTIU cabin telephone interface unit
CUMA Canadian Underwater Mine-countermeasures Apparatus
CVFR controlled visual flight rules
CVIS cabin video information system
CVR cockpit voice recorder
CYAW Halifax Shearwater Airport (Nova Scotia)
CYHZ Halifax International Airport (Nova Scotia)
CYQI Yarmouth Airport (Nova Scotia)
CYQM Greater Moncton Airport (New Brunswick)
D
D energy density expressed in J/m2
DAS Designated Alteration Station
DAU disk array unit
dB decibel
dBi decibel isotropic
dBm decibel referenced to 1 milliwatt
dBZ a unit of radar reflectivity used in meteorology
DC direct current
DCAS digitally controlled audio system
DDS The FAA's DAS, DOA, and SFAR 36 Program
DEU display electronic unit
DFDAU digital flight data acquisition unit
DFDR digital flight data recorder
DFO Department of Fisheries and Oceans
DIN Deutsche Industrie Norm
DITS digital information transfer system
DME distance measuring equipment
DMS Douglas Material Specification
DNA deoxyribonucleic acid
DND Department of National Defence
DOA Delegation Option Authorization
DPS Douglas Process Standard
DREA Defence Research Establishment Atlantic
DSIS Deep Seabed Intervention System
DTL Decorative PVF laminate
DTM digital terrain model
DU display unit
E
E electric field strength
E&E electrical and electronic equipment
EAD engine and alert display
EAPAS Enhanced Airworthiness Program for Airplane Systems
EC Environment Canada
ECM electronic countermeasures
EDP engine-driven hydraulic pump
EDT eastern daylight savings time
EEC electronic engine control
EEPROM electrically erasable programmable read-only memory
EIRP effective isotropic radiated power
EIS electronic instrument system
ELA electrical load analysis
ELT emergency locator transmitter
EMC electromagnetic compatibility
EMI electromagnetic interference
EMO Emergency Measures Organization (or Office)
EO engineering order
EPC Emergency Preparedness Canada
EPCU electrical power control unit
EPR engine pressure ratio
ESC environmental system controller
ETFE ethylene-tetrafluoroethylene
ETOPS Extended Range Twin Engine Operations
EUROCAE European Organisation for Civil Aviation Equipment
EXT extended
F
°F degree(s), Fahrenheit
F/A flight attendant
FA1W Northeast Region Area Forecast
FAA Federal Aviation Administration (USA)
FACN35 Canadian area forecast, District 35
FADEC full-authority digital electronic control
FAR Federal Aviation Regulation (USA)
FAUS5 US Area Forecast
FBS fixed-base simulator
FBV French Bureau Veritas
FCC flight control computer
FCOM Flight Crew Operating Manual
FCP flight control panel
FCRL flight crew reading light
FD flight director
FDAU flight data acquisition unit
FDCU fire detection control unit
FDM Flight Data Monitoring
FDR flight data recorder
FDU(A) Fleet Diving Unit (Atlantic)
FE flap extension
FEP fluorinated ethylene-propylene [resin]
FH flight hours
FIB focused ion beam
FL flight level
FMA flight mode annunciator
FMC flight management computer
FMS flight management system
FMU fuel metering unit
FO first officer
FOC Flight Operations Centre (Swissair)
FOCA Federal Office for Civil Aviation (Switzerland)
FOCUS flight operations computer system
FOEB Flight Operations Evaluation Board
FOO flight operations officer
FOQA flight operational quality assurance
fpm feet per minute
FR fluid-resistant [primer paint]
FS frame station
FSAW Flight Standards Information Bulletin for Airworthiness
FSB Flight Standardization Board
FSC fuel system controller
FSEG Fire Safety Engineering Group - University of Greenwich
FSR field service representative
FSS flight service station
ft. foot (feet)
FWD forward
G
g gravity
GB gigabyte
GB Swissair General/Basics: Flight Crew [manual]
GCU generator control unit
GES ground earth station
GHz gigahertz
GIS Geographic Information System
gpm gallons per minute
H
h hour(s)
HCU hydraulic control unit
HDD hard-disk drive
HDS Halon Distribution System
HDU head-end distribution unit
HF high frequency
HI Hollingsead International
HIRF high-intensity radiated field
HMCS Her Majesty's Canadian Ship
HMU hydro-mechanical unit
HPC high-pressure compressor
HPT high-pressure turbine
HSC hydraulic system controller
HTML Hypertext Markup Language
Hz hertz
I
IAS indicated airspeed
IC integrated circuit
ICA Instructions for Continued Airworthiness
ICAO International Civil Aviation Organization
IDG integrated-drive generator
IDN identification number
IFE in-flight entertainment
IFEN in-flight entertainment network [the IFE system of Interactive Flight Technologies]
IFR instrument flight rules
IFT Interactive Flight Technologies
IGV inlet guide vanes
IIC investigator-in-charge
ILS instrument landing system
IMC instrument meteorological conditions
in. inch(es)
in. Hg inches of mercury
INMARSAT International Maritime Satellite Organization
IPC Illustrated Parts Catalogue
IRU inertial reference unit
ISE International Submarine Engineering Ltd.
ISO International Organization for Standardization
ISOL isolation
ISVD in-seat video display
IVR image-based virtual reality
J
J joule
JAA Joint Aviation Authorities
JAR Joint Aviation Requirements
JCAB Civil Aviation Bureau of Japan
JFK John F. Kennedy [International Airport] (New York)
K
kB kilobyte
KBGR Bangor International Airport (Maine)
KBOS General Edward Lawrence Logan International Airport (Massachusetts)
kg kilogram
kHz kilohertz
KIAS knots indicated airspeed
km kilometre(s)
kPa kilopascal(s)
kt knot(s)
kV kilovolt(s)
kVA kilovolt-ampere
kW kilowatt(s)
L
L litre
L/min litres per minute
LAACO Los Angeles Aircraft Certification Office
LAN local area network
lat. latitude
LAV lavatory
lb pound(s)
lb/min pound(s) per minute
lbf pound force
LCD liquid crystal display
LEAF Laser Environmental Airborne Fluorosensor
LKP last known position
LLS laser line scan
LLSG Geneva International Airport (Switzerland)
LOI Letter of Intent
long. longitude
LOPA Layout of Passenger Accommodation
LP low pressure
LPC low-pressure compressor
LPT low-pressure turbine
LRU line replaceable unit
LRW Laurentides
LSAS longitudinal stability augmentation system
LVDT linear variable differential transducer
M
M Mach number
°M degree(s), magnetic compass
m metre
MAC mean aerodynamic chord
MACZFW mean aerodynamic chord zero fuel weight
MANOPS [ATC] Manual of Operations
UTC Time Elapsed Time (minutes) Event
0110:38 00:00 Unusual smell detected in the cockpit
0113:14 02:36 Smoke assessed as visible at some location in the cockpit; no smell reported in cabin
0114:15 03:37 SR 111 radio call: "Pan Pan Pan"; diversion requested naming Boston (It is unknown whether visible smoke was still present in the cockpit)
0115:36 04:58 Decision made to divert to Halifax, Nova Scotia
0120:54 10:16 Decision made to dump fuel
0123:45 13:07 CABIN BUS switch selected to OFF
0124:09 13:31 Autopilot 2 disengages, and the flight data recorder (FDR) begins to record aircraft system failures
0124:42 14:04 Emergency declared
0125:02 14:24 ATS receives last communication from SR 111
0125:41 15:03 Recorders stop recording
0131:18 20:40 Impact with water

For a more detailed description of the timeline, sequence of events, and flight profile, refer to sections 1.18.8.3 and 1.18.8.4, and to Appendix A – Flight Profile: Selected Events and Appendix D – Timeline.


[1]    All times are Coordinated Universal Time (UTC) unless otherwise noted. In UTC time, the flight occurred on 3 September 1998. For eastern daylight savings time, subtract four hours; for Atlantic daylight time, subtract three hours.

[2]    On 1 August 1997, McDonnell Douglas (MD) merged with The Boeing Company, and Boeing became responsible for the MD-11 type certificate.

[3]    Altitudes above 18 000 feet are indicated as flight levels (FL) and are based on a standard altimeter setting of 29.92 inches of mercury. To derive an approximate altitude from a flight level, add two zeros to the indicated FL. For example, FL330 is about 33 000 feet above sea level.

[4]    Pan Pan is an expression, spoken three times in succession, used in the case of an urgency: a condition concerning the safety of an aircraft or other vehicle, or of some person on board or within sight, but that does not require immediate assistance (as defined by International Civil Aviation Organization AN10II, Chapter 5, paragraph 5.3.1.1).

[5]    All altitudes below 18 000 feet are indicated as above sea level, unless otherwise noted. Note: Sea level is equivalent to mean sea level.

[6]    All headings are degrees magnetic unless otherwise noted.

[7]    The controller had indicated earlier to the crew that they would have about 10 nautical miles (nm) to fly before crossing the coastline. When initially cleared to turn left, the aircraft had been flying at almost 7 nm per minute and had travelled slightly farther north than the controller had originally estimated, before starting the turn.


Previous | Next

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

1.2  Injuries to Persons

Table 2: Injuries to Persons

  Crew Passengers Others Total
Fatal 14 215 - 229
Serious - - - -
Minor/None - - - -
Total 14 215 - 229

Post-accident medical and pathological information that describes the nature of the injuries is presented in Section 1.13, Medical Information.

Previous | Next

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

1.3  Damage to Aircraft

The aircraft was destroyed by the forces of impact with the water. Most aircraft debris sank to the ocean floor. Initially, some aircraft debris was found floating in the area where the aircraft struck the water, while other debris had drifted slightly west of the crash location. Over the next several weeks, debris from the aircraft was also found floating in shoreline areas and washed up on various beaches.

Previous | Next

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

1.4  Other Damage

Jet fuel was present on the surface of the water near the impact site for a few hours before evaporating. There was no apparent damage to the environment from the aircraft debris. The area surrounding the impact site was closed to marine traffic, including local fishery and tour boat operations, during salvage operations that lasted for approximately 13 months.

Previous | Next

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada
Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

1.5.1  General

The SR 111 flight crew consisted of a captain and a first officer. The cabin crew consisted of a maître de cabine (M/C) and 11 flight attendants.

A flight operations officer provided standard flight preparation support to the flight crew before their departure from JFK airport.

Two air traffic controllers at Moncton ACC had radio contact with the aircraft: a high-level controller and a terminal controller.

Previous | Next

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

1.5.2  Flight Crew

  1. 1.5.2.1 - Captain
  2. 1.5.2.2 - First Officer

Table 3: Flight Crew Information

  Captain First Officer
Age 49 36
Pilot licence Swiss Airline Transport Pilot Licence Swiss Airline Transport Pilot Licence
Medical expiration date 1 November 1998 1 July 1999
Total flying hours 10 800 4 800
Hours on type 900 230
Hours last 90 days 180 125
Hours on type last 90 days 180 125
Hours on duty prior to occurrence 3 3
Hours off duty prior to work period 27 27

1.5.2.1  Captain

The pilot-in-command (captain) of SR 111 was described as being in good health, fit, and not taking any prescribed medication. He was described as someone who created a friendly and professional atmosphere in the cockpit and was known to work with exactness and precision. It was reported that there was no tension in the cockpit when flying with this captain.

The captain began flying for recreation in 1966 at the age of 18. In 1967, he joined the Swiss Air Force and became a fighter pilot. He began his career with Swissair in July 1971 as a first officer on the McDonnell Douglas DC-9 and later transitioned as a first officer to the McDonnell Douglas DC-8.

He was upgraded to captain status in April 1983 on the DC-9 and flew the McDonnell Douglas MD-80 as pilot-in-command from 1986 to 1994. In August 1994, he completed transition training to fly the Airbus A320, and became an A320 captain and instructor pilot. In June 1997, he completed transition training on the MD-11. He was qualified and certified in accordance with Swiss regulations. (STI1-1) He held a valid Swiss airline transport pilot licence (ATPL). His instrument flight rules (IFR) qualifications for Category I and Category III approaches were valid until 21 October 1998. His flying time with Swissair totalled 9 294 hours. His last flying proficiency check was conducted on 23 February 1998.

The captain had never been exposed to a regulatory or administrative inquiry. There is no record to indicate that he had experienced an actual in-flight emergency at any time during his flying career.

As well as being a line pilot, the captain was an instructor pilot on the MD-11. He instructed in the full flight simulator on all exercises, including the pilot qualification training lesson where the Smoke/Fumes of Unknown Origin checklist is practised (see Appendix C – Swissair Smoke/Fumes of Unknown Origin Checklist). The captain was known to give detailed briefings to his students before, during, and after their simulator sessions. To increase his aircraft knowledge, the captain would question technical specialists in the maintenance department about the aircraft and its systems. During "smoke in the cockpit" training sessions, the captain required the students to explain all the steps and consequences of using the "electrical and air smoke isolation" (SMOKE ELEC/AIR) selector[8] prior to conducting the exercise. During these sessions, it was the captain's practice to ensure that the pilot reading the checklist would inform the pilot flying what services he or she was about to lose prior to turning the selector.

During wreckage recovery, a prescription for eyeglasses for the captain was found among the recovered personal effects. The prescription correction was for distance vision. No glasses identified as belonging to the captain were recovered. The available information indicates that the captain did not normally wear eyeglasses except sometimes for distance vision correction. The captain met the visual standard without glasses on his last aviation medical examination. The presence or absence of the captain's glasses would not have affected his ability to deal with the situations that he encountered in this occurrence.

Based on a review of the captain's medical records, there was no indication of any pre-existing medical condition or physiological factors that would have adversely affected his performance during the flight. His last medical examination took place on 29 April 1998; no medical restrictions applied to his pilot licence.

1.5.2.2  First Officer

The first officer was described as being in good health and as not taking any prescription medication. He was considered to be experienced, well qualified, focused, and open-minded in performing the duties of a first officer. His cockpit discipline was described as ideal. He was described as a partner in the cockpit, with a quiet and calm demeanour; he was assertive when appropriate.

The first officer started flying in 1979, became a Swiss Air Force pilot in 1982 and completed his full-time military service in 1990. He joined Swissair in 1991 as a first officer on the MD-80 while continuing to fly in the air force part-time as a fighter pilot. In December 1995, he transitioned to the Airbus A320 as a first officer. In May 1998, he successfully completed his training as a first officer on the MD-11. He held a valid Swiss ATPL, which was issued in August 1996.

The first officer had never been exposed to a regulatory or administrative inquiry. There is no record to indicate that he had experienced an actual in-flight emergency at any time during his flying career. He was qualified and had been certified in accordance with Swiss regulations. (STI1-2) His last proficiency check was on 16 April 1998.

The first officer had been an instructor on the MD-80 and A320, and at the time of the occurrence, was an instructor on the MD-11 as a simulator and transition instructor. He had accumulated 230 hours of flying time on the MD-11 and was described as having good knowledge of the aircraft systems. His flying time with Swissair totalled 2 739 hours.

Based on a review of the first officer's medical records, there was no indication of any pre-existing medical condition or physiological factors that would have adversely affected his performance during the flight. His last medical examination took place on 15 June 1998; no medical restrictions applied to his licence.


[8]    The SMOKE ELEC/AIR selector is also known as the SMOKE switch.

Previous | Next

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

1.5.3  Cabin Crew

The M/C and the other 11 flight attendants were fully qualified and trained in accordance with the existing Joint Aviation Authorities (JAA) regulatory requirements. (STI1-3)

Previous | Next

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

1.5.4  Seventy-Two-Hour History

A review of the flight and duty times for the flight and cabin crew revealed that they were all in accordance with the limitations prescribed by Swissair policies and JAA regulations.

The captain was off duty from Saturday, 29 August, up to and including Monday, 31 August, and was reported to have been well rested prior to departing for the outbound flight from Zurich to Geneva to New York on Tuesday, 1 September. Normal crew rest time was allocated to the crew while in New York.

The first officer was off duty from 30 to 31 August, and was reported to have been well rested prior to reporting for duty on Tuesday, 1 September.

On 1 September the two members of the flight crew, and 7 of the 12 cabin crew deadheaded[9] from Zurich to Geneva on Swissair Flight 920 (SR 920). The aircraft departed the gate in Zurich at 0643, arriving at the gate in Geneva at 0723. The remaining five flight attendants joined the rest of the aircraft crew in Geneva. The flight and cabin crews assumed flying duties on Swissair Flight 110 (SR 110), Geneva to New York. SR 110 departed the gate in Geneva at 1018, arriving in New York at 1835 on 1 September. The aircraft used for SR 110 was not the accident aircraft.

In accordance with Swissair procedures, on 2 September 1998, the day of the homebound flight to Geneva, the pilots received at their hotel a pre-flight information package from the Swissair Flight Operations Centre (FOC) at JFK airport. Included in this package was flight routing, weather, and aircraft weight information (i.e., weight based on preliminary information).

The aircraft crew checked out of their hotel in New York at 1750 local time (2150 UTC) on 2 September 1998 and arrived at the airport one hour before the scheduled departure time for SR 111 of 1950 local time (2350 UTC). On arrival at the airport, all aircraft crew members passed through terminal security and checked their bags at the Swissair check-in area. The cabin crew proceeded directly to the aircraft. The pilots reported to the FOC where they completed their flight planning and then proceeded to the aircraft. The flight departed the gate in New York at 1953 local time (2353 UTC).

The aircraft crew's circadian[10] time was likely close to Swiss time (UTC plus two hours) as they would not have had enough time in New York to significantly adjust their circadian rhythm to local (New York) time. Their circadian time was not considered to be a factor in the occurrence.


[9]    Deadheading refers to the travel of aircraft crew as passengers, who are not on active duty on that flight.

[10]    Circadian refers to a 24-hour biological period or cycle.

Previous | Next

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

1.5.5  Air Traffic Controllers

All of the Nav Canada air traffic controllers involved with the SR 111 flight were current and qualified for their positions in accordance with existing Canadian regulations. The controllers were considered to be suitably experienced (see Table 4) and were being supervised as required. At the time of the occurrence, the workload of the controllers in the Moncton ACC was assessed as light. The initial SR 111 radio communications with Moncton ACC were handled by the high-level controller who, at 0118:11, handed off the ATS function to the terminal radar controller for the approach and landing at Halifax.

Table 4: Air Traffic Controllers' Experience

  High-Level Controller Terminal Radar Controller
Age 32 51
Licence Air Traffic Control Air Traffic Control
Experience as a controller 9 years 26 years
Experience as an IFR controller 9 years 26 years
Experience in present unit 3.5 years 26 years
Hours on duty before accident 5 8
Hours off duty before work period 72 16.25

Previous | Next

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

1.6  Aircraft Information

This section provides the following information:

  • A general description of the occurrence aircraft; and
  • A description of the operation, airworthiness, and maintenance of specific aircraft systems (environmental, automatic flight, warnings, communications, electrical, fire protection, etc.) and equipment deemed relevant to the occurrence investigation.

The systems and equipment described herein are specific to Swissair's MD-11 configuration and may not be accurate for other MD-11 configurations.

  1. 1.6.1 - General
  2. 1.6.2 - Environmental (Air) System
  3. 1.6.3 - Ditching Mode
  4. 1.6.4 - Auto Flight System
  5. 1.6.5 - Electronic Instrument System
  6. 1.6.6 - Flight Management System
  7. 1.6.7 - Warnings and Alerts
  8. 1.6.8 - Standby Flight Instruments
  9. 1.6.9 - Communications Systems
  10. 1.6.10 - Electrical System
  11. 1.6.11 - In-Flight Entertainment Network
  12. 1.6.12 - Aircraft Fire Protection System
  13. 1.6.13 - Flight Control System
  14. 1.6.14 - Fuel System
  15. 1.6.15 - Hydraulic System
  16. 1.6.16 - Cockpit Windows
  17. 1.6.17 - Landing Gear
  18. 1.6.18 - Aircraft Interior Lighting
  19. 1.6.19 - Emergency Equipment
  20. 1.6.20 - Powerplants
  21. 1.6.21 - Landing Performance
  22. 1.6.22 - Aircraft Maintenance Records and Inspection

Previous | Next

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

1.6.1  General

  1. 1.6.1.1 - MD-11 Design and Configuration
  2. 1.6.1.2 - Weight and Balance
  3. 1.6.1.3 - Aircraft Coordinate System
  4. 1.6.1.4 - Cockpit Attic and Forward Cabin Drop-Ceiling Areas – Description

Table 5: General Information about the Occurrence Aircraft (HB-IWF)

Manufacturer McDonnell Douglas Corporation
Type and Model MD-11
Year of Manufacture 1991
Serial Number (SN) 48448
Certificate of Airworthiness Issued 28 July 1991
Total Airframe Time (hours) 36 041
Engine Type (number of) Pratt & Whitney 4462 (3)
Maximum Take-Off Weight 285 990 kilograms (kg)
Recommended Fuel Types Jet A, Jet A-1, JP-5, JP-8, Jet B
Fuel Type Used Jet A

1.6.1.1  MD-11 Design and Configuration

The McDonnell Douglas MD-11 design project began in 1986. The MD-11 design is structurally based on the McDonnell Douglas DC-10 design (see Figure 1 and Figure 2). The MD-11 was designed for more economical and efficient operation than the DC-10, by incorporating modern, automated systems. The redesign automated most of the functions that were performed by the flight engineer in the DC-10, thereby allowing for a two-crew cockpit. The first MD-11 flight was on 10 January 1990 and delivery of the aircraft to the first customer was on 7 December 1990. The occurrence aircraft was manufactured in 1991 and was put directly into service by Swissair.

As the MD-11 was manufactured and certified in the United States (US) in accordance with applicable Federal Aviation Regulations (FAR), the regulatory focus of this report is directed toward the Federal Aviation Administration (FAA). Many civil aviation authorities (CAA) have drafted or harmonized their respective certification and continuing airworthiness regulations based on the FAA model; therefore, the issues in this report may also apply to other regulatory authorities.

The occurrence aircraft was configured with 241 passenger seats: 12 first class, 49 business class, and 180 economy class. The first- and business-class seats were equipped with an in-flight entertainment system,[11] certified and installed in accordance with a US FAA Supplemental Type Certificate (STC).

1.6.1.2  Weight and Balance

Weight and balance calculations completed after the occurrence determined that the actual take-off weight for SR 111 was approximately 241 100 kg. The centre of gravity (C of G) was calculated to be 20 per cent mean aerodynamic chord (MAC). Other than very small differences, the post-occurrence calculations confirmed that the weight and balance calculations used for dispatch were accurate. (STI1-4) The aircraft's weight was within limits, and throughout the flight the C of G was within the normal range (15 to 32 per cent MAC). The maximum allowable landing weight for the aircraft was 199 580 kg; the maximum overweight landing weight, allowable under certain conditions, was 218 400 kg. In an emergency, from an aircraft structural limit perspective, the aircraft can land at any weight; however, operational aspects, such as required stopping distance versus available runway distance, must be considered.

1.6.1.3  Aircraft Coordinate System

The MD-11 fuselage comprises six major sections and two minor sections (see Figure 2). The major sections extend from Section B, the nose/cockpit area of the aircraft, to Section G, the aft fuselage section. The two minor sections, sections 6 and 5, were inserted fore and aft of Section E to extend the length of the original DC-10 fuselage. Each fuselage section consists of the external skin, internal circumferential frames, and longitudinal stiffening members (longerons and intercostals). Figure 2 also shows the locations of numerous manufacturing stations (STA), fuselage sections, the forward doors, lavatories (LAV), and galleys.

An X, Y, Z Cartesian coordinate system is used to identify any point within the aircraft.

  • The X-axis extends laterally across the width of the aircraft. Lateral coordinates are measured in inches left or right of the fuselage longitudinal centre line. From the centre line toward the left wing, locations are positive coordinates (e.g., X= 80); locations toward the right wing are negative coordinates (e.g., X= –80).
  • The Y-axis extends longitudinally from the nose to tail, is expressed in STAs, and is measured in inches aft of a designated point in front of the aircraft. For the MD-11, the tip of the nose of the aircraft is located at STA 239 and the cockpit door is located at STA 383.
  • The Z-axis extends vertically through the aircraft. Vertical coordinates are measured in inches above or below the waterline (Z= 0), which, in the MD-11, is located 18 inches above the cabin floor. The cabin floor is therefore located at Z= –18.

1.6.1.4  Cockpit Attic and Forward Cabin Drop-Ceiling Areas – Description

The following section describes the cockpit attic and forward cabin drop-ceiling areas (see Figure 2, Figure 3, Figure 4, Figure 5, Figure 6, and Figure 7); the fire damage[12] and fire propagation in these areas is discussed in other sections of this report.

The space above the cockpit ceiling liner and the passenger cabin ceiling is referred to as the "attic" (see Figure 2). In Swissair MD-11 aircraft, the attic was divided at the cockpit rear wall. On the right side, the aluminum cockpit wall extended vertically to provide the division. On the left side, a single vertical smoke barrier was installed. (See Figure 3.)

The smoke barrier assembly above the left half of the cockpit rear wall consisted of a curtain made of nylon elastomer-coated cloth that was suspended from a curved aluminum alloy curtain rod. Hook-and-loop fastener[13] was used around most of the outer periphery of the cloth to attach it to the curtain rod, as well as to attach it to the adjacent aircraft structure along the bottom and right side. Thermal acoustic insulation blanket (insulation blanket) splicing tape was installed along the entire top edge of the smoke barrier to close gaps between the rod and the adjacent insulation blankets. The smoke barrier was designed with the following openings: three near the top of the curtain to permit the engine fire shut-off cables to pass through and two near the centre of the curtain to accommodate the installation of the cockpit air ducts.

Regulations require the installation of a smoke barrier between the cockpit and the rear of the aircraft in cargo and combination cargo/passenger configurations. However, there is no regulatory requirement to install smoke barriers in passenger aircraft, nor is there a requirement for the smoke barrier to meet a fire rating or fire blocking standard specific to a passenger aircraft application. Regardless, the barrier was certified to meet general aircraft material requirements and was installed in the aircraft during manufacture.

Examination of other Swissair MD-11 aircraft in the Swissair fleet disclosed that openings existed in the smoke barriers, and in areas adjacent to the barrier. Some of these openings were located at conduit and wire run locations that pass through or above the cockpit rear wall. The top edge of the rear, right cockpit wall near STA 383 has a cut-out in it to permit the passage of wire bundles and conduits. (See Figure 4 and Figure 5.)

Three 102-centimetre (cm) (40-inch) long conduits[14] and five wire bundles pass over the cockpit rear wall at this point, and continue aft over the top of Galley 2 between STA 383 and STA 420. (See Figure 3, Figure 4, Figure 5, and Figure 7.) The ends of the conduits were not required to be sealed and were found unsealed in other MD-11 aircraft that were examined. These conduits and wire bundles are attached by straps to a series of wire support brackets located at STA 383, 392, 401, 410, and 420. The wire bracket positioned at STA 383 is at a slight angle relative to the cockpit wall, which is directly below it. The top edge of this bracket, and attached wire bundles, are in contact with the metallized polyethylene terephthalate (MPET)–covered insulation blanket. Each of the conduits protrude forward of the cockpit wall by varying amounts because of the angle of the wall to the bracket.

Typically, the forward protrusion of the outboard conduit is the shortest of the three and the forward protrusion of the inboard conduit is the longest. These lengths, as measured from the bracket, vary from approximately 2.5 to 8 cm (1 to 3 inches) for the outboard and middle conduits. The inboard conduit was not used for any of the in-flight entertainment network (IFEN) installations. The cut-out extends downward approximately 8 cm (3 inches) from the top of the wall and is approximately 48 cm (19 inches) wide. A piece of closed-cell polyethylene foam containing fire retardant additives (i.e., part number (PN) NBN6718-83; Douglas Material Specification (DMS) 1954, Class 1, Grade 4101) is installed at this location to act as filler material for the cut-out.

Between STA 366 and STA 383 there are a number of wire support brackets installed in the fore-aft direction. These brackets are used to support wire bundles routed from behind the observer's station down into the avionics compartment; this area is commonly referred to as the "ladder area."[15] The aft end of the top bracket in the "ladder" is located near the outboard end of the cut-out in the cockpit wall (see Figure 3 and Figure 5). The brackets, and many of the wire bundles, are pressed up against, and closely follow, the curved contour of the fuselage over-frame MPET-covered insulation blankets.

Just aft of the right side of the cockpit rear wall, above Galley 2, a sound-suppression muff assembly (muff assembly) was installed around a splice junction of the conditioned air riser duct assembly (see Figure 6). The muff assembly uses an MPET-covered insulation blanket secured at both ends by hook-and-loop fasteners.

A second type of closed-cell polyethylene foam (PN ABE7049-41) was used around the windshield defog terminal blocks on the left side of the cockpit. A sample of the second type of foam (PN ABE7049-41) was removed from a Swissair MD-11 aircraft and tested. When the sample specimen was exposed to a small flame, the specimen ignited easily and burned.

Both of these foam materials were specified to DMS 1954, Class 1, Grade 4101, which states that the foam should possess fire-retardant additives and be certified to pass a 12-second vertical burn test as required in FAR 25.853, Appendix F. Literature indicates that both foams met FAR 25.853, Appendix F for commercial aircraft interior compartment components.

The manufacturer's material safety data sheet product code 37076 for the Dow Chemical Ethafoam® 4101, PN NBN6718-83, dated 23 August 1993, and current product information indicate that this polyethylene foam is combustible[16] and should not be exposed to flame or other ignition sources.

No foam was identified from the cockpit area of the occurrence aircraft.

In the Swissair MD-11s, the forward end of the muff assembly comes into close proximity to the lower right edge of the smoke barrier, and to the vent duct assembly for Galley 2. The galley vent duct, which is designed to exhaust odours and hot air from the galley when in operation, was not connected to the top of Galley 2, as Galley 2 was not electrically powered and not in service. A silicone elastomeric end cap was placed over the vent duct to close it off. The cap was located between the aft side of the cockpit rear wall and the forward side of one of the three riser ducts (see Figure 4 and Figure 6).

Five wire bundles and three conduits run aft from the cockpit and over the top of the riser duct assembly. The majority of the wire bundles descend from the wire support bracket at STA 420 to pass under the R1 door, flapper door ramp deflector. This drop in the wire bundles is generally referred to as the "waterfall" area (see Figure 7). Two of the wire runs, namely FDC and FBC, are clamped together and attached to a ceiling support tube located at approximately STA 427. This clamping arrangement is referred to in this report as a "marriage clamp." The ramp deflector is used to minimize the possibility of the forward right passenger door flapper panel from damaging adjacent wire assemblies if the flapper panel torsion spring should fail. The door flapper panel moves with the passenger cabin door when the door is raised or lowered.


[11]    The in-flight entertainment system installed in the occurrence aircraft was referred to as the in-flight entertainment network.

[12]    Fire damage is defined as heat and smoke damage as caused by a fire.

[13]    Velcro® is a commonly known brand of hook-and-loop fastener.

[14]    The conduits were identified by part number ABP7646-39 as 1.0 (inside diameter) x .020 (thick) x 40 inches long. Measurements of similar conduits on other MD-11 aircraft showed they could be as long as 108 centimetres (cm) (42.5 inches).

[15]    The wire brackets and the frames to which they are mounted are similar in appearance to a ladder. This area is commonly referred to as the "ladder area."

[16]    A material that will ignite and burn when sufficient heat is applied to it.

Previous | Next

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

1.6.2  Environmental (Air) System

  1. 1.6.2.1 - General
  2. 1.6.2.2 - Air Distribution System – Cockpit and Cabin
  3. 1.6.2.3 - Passenger Cabin Air System
  4. 1.6.2.4 - Air Conditioning – Smoke Isolation System

1.6.2.1  General (STI1-5)

Outside air is pressurized by each of the three engines. This pressurized air is bled off the engines to provide a source of heated and pressurized air to operate the various environmental subsystems, including the air conditioning packs and pressurization systems (see Figure 8). The three air packs are contained in compartments located to the left and right of the nosewheel well area. Each air pack supplies conditioned air to a common manifold located below the cabin floor.

Air from the common manifold travels through a self-contained distribution system of lines and ducts, and enters the cockpit and passenger areas via outlets located throughout the aircraft. Anomalies, such as leaking engine oil seals, can sometimes introduce contaminants, such as engine lubricating oil, into the bleed air system. Pyrolysis of these contaminants can give rise to potential smoke and odours in the conditioned air supply. Incidents where smoke or odours have entered the cockpit and passenger cabin through the bleed air system of commercial aircraft as a result of contamination have been reported frequently.

Air from the cockpit, passenger cabin, and the remainder of the pressure vessel[17] is vented overboard through an outflow valve located on the left side of the aircraft slightly ahead of the wing.

For normal operations, the air conditioning system is automatically controlled by the environmental system controller (ESC). The air system can also be operated manually by the pilots using the air systems control panel (ASCP) located in the overhead switch panel in the cockpit (see Figure 8 and Figure 11).

Insulation blankets are used extensively throughout the aircraft to wrap the air distribution ducts to provide a thermal barrier. They are also installed between all fuselage frames; in some areas a second layer is installed over the frames. These insulation blankets provide a barrier against hot or cold exterior temperatures, and noise that could otherwise enter the passenger cabin and cockpit.

1.6.2.2  Air Distribution System – Cockpit and Cabin

In the Swissair MD-11 configuration, conditioned air from the common air manifold located below the cabin floor is distributed to five zones through lines and ducts; Zone 1 is the cockpit and zones 2 to 5 are areas within the cabin (see Figure 8).

The ducts and lines continuously supply the cockpit with 500 cubic feet per minute (cfm) of conditioned fresh air regardless of the flow setting selected for the passenger cabin. The air enters the cockpit from numerous vents, including three outlets from the overhead diffuser assembly, window diffusers, overhead individual air outlets, and foot-warmer outlets (see Figure 8, Figure 9, and Figure 10). All of these cockpit vents can be fully closed with the exception of the centre overhead diffuser, which has a minimum fixed opening. Manually operated controls are used to regulate the airflow from the overhead diffuser assembly and the window diffusers. Three rotary controls for the overhead diffuser assembly are located at the rear of the overhead ceiling liner. The right window diffuser slide control is located in the right ceiling liner, above the first officer's position aft of the windscreen. The left window diffuser slide control is located in the left ceiling liner behind the captain's position, just inboard of the left aft window.

Air in the cockpit generally flows from the diffusers down and around the flight crew seats, then forward past the rudder pedals and into the avionics compartment below the cockpit floor. (See Figure 10.)

Although the incoming conditioned air from all three air packs is mixed in the common manifold before the air enters the distribution ducts, the proximity within the manifold of the Air Pack 1 inlet and the cockpit and Zone 5 outlets is such that an odour from Air Pack 1 could reach the cockpit and Zone 5 before reaching the other zones.

Conditioned air for the passenger cabin areas is ducted to overhead plenums and directed down toward the floor. This air circulates around the passenger seats, then migrates to airflow vent boxes located along both sides of the passenger cabin floor. Air from the airflow vent boxes is directed through under-floor tunnels to the outflow valve. The outflow valve consists of two small doors located on the lower left side of the fuselage at STA 920. These doors are regulated open or closed to control cabin pressurization.

1.6.2.3  Passenger Cabin Air System

The passenger cabin air system in the MD-11 is equipped with an economy (ECON) mode[18] that mixes fresh conditioned air with recirculated cabin air and distributes it to the cabin zones (see Figure 8). The cabin air system consists of four recirculation fans and one individual air fan, called a "gasper" fan, which are all located above the ceiling in the forward and centre cabin area. In the ECON mode, the recirculation fans draw air from above the ceiling. This air is then mixed with the fresh conditioned air supply before being distributed back into the passenger cabin. Normally, the four recirculation fans operate continuously, but can be manually turned off by selection in the cockpit of either the ECON switch, the CABIN BUS switch, or the SMOKE ELEC/AIR selector. The ESC will automatically shut off the recirculation fans when there is a demand for a lower cabin temperature or when a generator overload occurs.

The gasper fan provides a constant supply of air to the passengers' individual air outlets, and operates independently of both the ECON mode and the temperature selection. The gasper fan is turned off by selecting the CABIN BUS switch to the OFF position, or by selecting the SMOKE ELEC/AIR selector to the 3/1 OFF position.

There is a thumbwheel PAX LOAD selector on the ASCP to allow the pilots to input the number of passengers on board to the nearest 10. The ESC schedules the flow of conditioned air to the cabin based on this input. In the ECON ON configuration, the MD-11 air conditioning schedule is determined by combining 10 cfm of fresh air for each of the passengers, with 700 cfm from each of the four recirculation fans. Swissair chose to use a default setting of 260 passengers with all four recirculation fans operating. This default setting results in a mixed airflow of 5 400 cfm of fresh and recirculated air to the passenger cabin. In the ECON OFF configuration, the air conditioning schedule is set to 5 500 cfm to the passenger cabin.

Each of the recirculation fans and the gasper fan incorporates a high-efficiency particulate air filter (Donaldson Company PN AB0467286) constructed of pleated microglass fibre media with aluminum separators to maintain pleat spacing. The filter was life tested to the American Society of Heating, Refrigeration and Air Conditioning Engineers[19] Standard 52.1, meets military standard (MIL-STD)-282,[20] and is rated by its ability to capture and retain oil particles that are 0.3 micrometres (microns) in size.[21]

The filter is rated to remove 95 per cent of all 0.3 micron–size particles, and various capture mechanisms within the filter result in a higher efficiency in removing particles both smaller than, and larger than, 0.3 microns. For example, most tobacco smoke particulates, which are typically 0.01 to 1.0 micron in size, would be removed, as would larger particles, such as those produced when thermal acoustic insulation cover material burns.

During the initial stages of the fire on board the occurrence aircraft, the filter efficiency would have increased over time as particulates became entrapped in the filter. It would be expected that the filters would remove most of the smoke[22] particulates from the recirculated air during the initial stages of the in-flight fire. Although this filter is not classified as an odour-removing type, some odours associated with particulate contaminants would also be expected to be removed or diminished, while gaseous odours would be expected to pass through the filter.

1.6.2.4  Air Conditioning – Smoke Isolation System

If smoke or fumes are identified as coming from the air conditioning system, the flight crew are trained to use the Air Conditioning Smoke Checklist (see Appendix B). The checklist directs the flight crew to isolate the smoke source by selecting ECON OFF. If this does not isolate the smoke source, the next action on the checklist, after pushing the AIR SYSTEM push button to MANUAL, is to re-select ECON ON and select one of the air conditioning packs off. If this does not isolate the smoke source, the pack is selected back on and another pack is selected off. Each of the three air conditioning packs can be individually shut down to determine which of the three is the origin of the smoke. Air conditioning packs are shut down by selecting the air system to MANUAL, and then turning the appropriate air conditioning pack off on the ASCP; in turn, this closes the respective pack flow control valve. If the smoke decreases, the bleed air source for the air conditioning pack can be turned off, and the respective isolation valve can be opened.


[17]    For the purposes of this report, the pressure vessel or pressurized portion of the aircraft includes cockpit, cabin, avionics compartments, cargo compartments, and the various accessory spaces between the passenger compartment and the pressure hull.

[18]    The ECON mode is the default mode selected under normal operating conditions as it has an associated fuel saving.

[19]    An internationally recognized American organization specializing in assessing and recommending air quality standards in air conditioned and ventilated environments, including those in aircraft.

[20]    MIL-STD-282 refers to filter units, protective clothing, gas mask components, and related products: performance test methods.

[21]    To establish perspective relative to a more familiar item, the size of a human hair is about 70 microns in diameter.

[22]    For the purposes of this report, smoke is defined by the American Society of Heating, Refrigeration and Air Conditioning Engineers as small solid or liquid particles, or both, produced by incomplete combustion of organic substances such as tobacco, wood, coal, oil, and other carbonaceous materials. The term "smoke" is applied to a mixture of solid, liquid, and gaseous products, although technical literature distinguishes between such components as soot or carbon particles, fly ash, cinders, tarry matter, unburned gases, and gaseous combustion products. Smoke particles vary in size, the smallest being smaller than 1 micron. The average often ranges between 0.1 and 0.3 microns.

Previous | Next

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

1.6.3  Ditching Mode

In the event that an emergency water landing is required, the aircraft can be configured for ditching by activating a DITCHING push button located to the right of the cabin pressure control panel on the overhead switch panel. When pushed, the switch provides a signal to the ESC, which then controls the various systems to prepare the aircraft for ditching. The existing cabin altitude is maintained during descent until the aircraft pressurization reaches zero differential, or until the aircraft descends through 2 500 feet, at which point the air packs are shut down. To maintain a watertight fuselage, the air pack ram air doors, the outflow valve, and the avionics and aft tunnel venturi valves are closed.

Examination of the SR 111 wreckage revealed that one air pack had been shut down. None of the other components expected to be closed if the DITCHING mode was selected were found in the ditching configuration. This would indicate that the DITCHING push button was not pushed; however, it could not be determined what effects the fire might have had on the serviceability of the associated systems.

Previous | Next

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

1.6.4  Auto Flight System

The MD-11 is equipped with an auto flight system (AFS) that is an integral part of the automatic and manual control system of the aircraft. The AFS consists of two, dual-channel flight control computers (FCC) with two integrated autopilots, flight directors (FD), autothrottle, and engine trim controls. Manual override of the automatic flight controls and autothrottle is always available.

The AFS hardware consists of the two FCCs, a dual-channel flight control panel (FCP), an automatic flight system control panel, a duplex flap limit servo, a duplex elevator load feel servo, a duplex autothrottle servo, and two control wheel force transducers. The AFS provides fail-operational Category IIIB auto-land through ground roll-out, and integrated windshear detection/warning with autopilot, FD, and autothrottle guidance escape capability.

The FCP, located on the glareshield control panel, provides the interface between the flight crew, the AFS, and the flight management system (FMS). The AFS incorporates airspeed and flight path protective features that automatically override the selected airspeed or flight path commands or both to prevent over or under speed.

Each dual-channel FCC has two similar functioning lanes. Each lane has two central processing units, which continually monitor the health of the other lane. A detected fault in the operating lane will automatically disconnect that function. For example, an autopilot fault will result in the autopilot disconnecting. Should this happen, the autopilot disengage warning system would activate a flashing red "AP OFF" alert on the flight mode annunciator and a cyclic (warbler) aural warning tone. The warbler can be reset, after at least one cycle of the tone has been completed, by pushing either of the autopilot disconnect switches installed on the outboard horn of both control wheels or by re-engaging the autopilot.

Each FCC receives inputs from the following sources:

  • Inertial reference units 1, 2, 3 (IRU-1, -2, -3);
  • Air data computers 1, 2 (ADC-1, -2);
  • Radio altimeter 1, 2 (RA-1, -2);
  • Both instrument landing systems (ILS), Flight Management Computer 1, 2 (FMC-1, -2);
  • All three full-authority digital electronic control (FADEC) engine control units, flight control sensor data, selected references from the FCP; and
  • Other information, such as weight on wheels, and gear and flap position.

The FCCs send digital signals to the electronic instrument system (EIS) for display, and control signals to actuators for control of pitch, roll, yaw, and engine thrust.

Previous | Next

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

1.6.5  Electronic Instrument System

The MD-11 EIS consists of six display units (DU) mounted in the instrument panel. DUs 1, 2, and 3 are on the left side; DUs 4, 5, and 6 are on the right side (see Figure 11). The captain's DUs (DUs 1, 2, and 3) receive display information from display electronic unit (DEU) 1, and the first officer's DUs (DUs 4, 5, and 6) receive information from DEU 2. DEU 3 (auxiliary) is continuously available as a spare and may be selected for use by either pilot through the EIS source input select panel.

DUs 1 and 6 normally display primary flight information, such as heading, attitude, airspeed, barometric and radio altitude, vertical speed, vertical and lateral deviation, aircraft operating limits, configurations, and flight modes.

DUs 2 and 5 are normally navigation displays (ND). The ND has four modes of operation as follows:

  • MAP mode – Displays the active flight plan referenced to the aircraft position and heading in the form of a pictorial representation; this is the mode normally used with FMS navigation.
  • PLAN mode – Displays the flight plan only, with the aircraft symbol centred on the next waypoint.
  • VOR mode – Displays a compass rose, two bearing pointers (for non-directional beacons (NDB) and very high frequency omni-directional range (VOR)), a course deviation indicator (for VOR navigation and approaches), headings, ground speed, true airspeed (TAS), distance measuring equipment, and weather information; this mode is normally used for conventional (NDB and VOR) navigation and approaches.
  • APPR mode – Displays the same information as the VOR mode, except that the course source is an ILS receiver instead of a VOR; this mode is used for ILS front-course and back-course approaches.

All the modes display wind, clock, and next waypoint information.

DU 3 is normally used to show the engine and alert display (EAD), which includes information such as engine pressure ratio (EPR), exhaust gas temperature, N1,[23] N2,[24] fuel flow, and alert messages. DU 4 is used for the system display (SD), which normally shows either secondary engine data (i.e., engine oil temperature, pressure and quantity), or aircraft systems synoptic pages.[25] The synoptic pages display the configuration and status of the hydraulic, electric, air, and fuel systems. They also include a configuration page, miscellaneous page, systems status page, and a consequence page (see Table 6).

Electrical power is supplied by the left emergency 115 volts (V) alternating current (AC) bus for DUs 1 and 3; by the right emergency 115 V AC bus[26] for DUs 4, 5, and 6; and by the 115 V AC Bus 1 for DU 2. If all three engine-driven electrical generators were to fail, DU 1 and DU 3 would automatically receive electrical power from the aircraft battery. When the air-driven generator (ADG) is deployed and selected to the electric mode, DUs 1, 3, 4, 5, and 6 can be powered, and the aircraft battery charge will be maintained.

lf flight information data to the DU is invalid, that information is removed from the screen and replaced by either a red or amber "X" symbol covering the area of removed data. A red "X" requires immediate flight crew action to restore the lost data. If the "X" is amber the flight crew can decide to delay action to restore the data. A failed DEU is indicated by a red "X" displayed across the entire black screen of the DU. The loss of electrical power to a DU will result in a blank screen. The loss of any DU would cause the remaining DUs to reconfigure automatically. The priority logic used in reconfiguring is to keep a primary flight display (PFD) available at all times; that is, if only one DU were functioning, it would maintain the PFD. In the failure priority logic, the second-to-last operating DU would display the EAD.


[23]    N1 is the rotational speed of the low-pressure compressor and the low-pressure turbine.

[24]    N2 is the rotational speed of the high-pressure compressor and the high-pressure turbine.

[25]    A synoptic page contains a detailed summary of the status of a particular aircraft system, showing all normal or abnormal indications, and is viewed on the system display.

[26]    The report refers to the left and right emergency 115 volts (V) alternating current buses as the left and right emergency AC buses respectively.

Previous | Next

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

1.6.6  Flight Management System (STI1-6)

The FMS is used for flight planning, navigation, performance management, aircraft guidance and flight progress monitoring. The FMS provides a means for the flight crew to select various flight control modes via the FCP, and the means to enter flight plans and other flight data via the multifunction control display unit (MCDU) (see Figure 11). Flight progress is monitored through the MCDU and the EIS.

After data entry by the flight crew, the FMCs will generate a flight path profile; for example, from the origin airport to the destination airport. The FMC then guides the aircraft along that profile by providing roll commands, mode requests, speed and altitude targets, and pitch commands (while "on path" during descent) to the FCCs.

The FMC navigation database includes most of the information that is available to pilots from navigation charts and approach charts. The flight plan that was entered into the FMS before departure from JFK airport in New York did not include the Halifax International Airport. Therefore, when the pilots decided to divert and land at the Halifax airport, some reprogramming of the FMS would have been required. Before the pilots could select an instrument approach from the FMC database, the new destination of Halifax would have to be programmed into the FMS.

The MD-11 is not certified to conduct back-course approaches using the FMS. The FMS will prevent the display and selection of back-course approaches from the navigation database.[27] Conventional navigation and approach methods are available to the flight crew.


[27]    Back-course localizer instrument approaches are referred to as backbeam approaches in Swissair manuals and lexicon.

Previous | Next

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

1.6.7  Warnings and Alerts

The MD-11 alerting system incorporates master warning and master caution lights on the glareshield. Alerts are displayed in the cockpit on the EAD, the SD, or both. Alerts are categorized into four levels (3, 2, 1, and 0) and are presented in three columns in the lower third of the EAD.

Level 3 (red) alerts indicate emergency operational conditions that require immediate flight crew awareness and immediate corrective or compensatory action by the pilots. All Level 3 alerts have an aural warning. Level 2 (amber) alerts indicate abnormal operational system conditions that require immediate flight crew awareness and subsequent corrective or compensatory action by the pilots. Level 1 (amber) alerts may require a maintenance action prior to take-off, a logbook entry, or confirmation of desired system configuration. A Level 1 (amber) alert in flight may require flight crew action as prompted, and requires an aircraft logbook entry. Level 0 (cyan) alerts usually indicate operational or aircraft systems status information.

If a system generates an alert or warning, the applicable cue switch on the system display control panel (SDCP) illuminates, enabling the pilots to identify the system. Activating the illuminated system cue switch on the SDCP produces the associated system synoptic page on the SD, and extinguishes the cue light, master warning, and caution lights, if they are on. Table 6 shows available cue switches and their associated systems synoptic page.

Table 6: Cue Switches and Associated Systems Synoptic Pages

Cue Switch Associated Systems Synoptic Page
ENG engine
HYD hydraulic system
ELEC electrical system
AIR air system
FUEL fuel system
CONFIG flight controls and landing gear
MISC alerts and consequences for various miscellaneous systems

The FDR revealed that the air system synoptic page (Air Page) was selected by the pilots sometime between 0111:49 and 0112:52, shortly after the unusual odour was first detected in the cockpit. This page displays environmental system operation of the manifolds, duct temperatures, zone temperatures, smoke and heat detectors in the cargo compartments, pressurization readouts, bleed-air readout, and air conditioning pack readouts. Aside from the flight crew selection of the Air Page, the FDR records only the following potentially related data: air packs 1, 2, and 3 OFF; aft and forward cargo heat; bleed-airs 1, 2, and 3 OFF; cabin pressure warning; and cabin altitude warning. The FDR does not record individual duct or zone temperatures, cabin smoke, lavatory smoke, or any system cues displayed on the SDCP.

Previous | Next

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

1.6.8  Standby Flight Instruments (STI1-7)

Two standby flight instruments (one that displays the aircraft's attitude, and one that displays the aircraft's altitude and airspeed) are located in the centre of the lower instrument panel for use by the captain or first officer (see Figure 11). There was no provision for a self-contained, independent electrical power supply for standby communication and electronic navigation capability, nor was this required by regulation.

The standby attitude indicator (SAI), sometimes referred to as a gyro horizon, provides a vertical, stabilized reference that makes it possible to visually monitor the aircraft's attitude, in pitch and roll, with respect to the horizontal plane. The SR 111 SAI was self-contained and electrical power was being supplied by the aircraft's battery bus. A warning flag appears on the face of the instrument if electrical power to the unit is lost or removed, or if the gyro speed decays to a predetermined speed below which the gyro has insufficient rotational speed to provide reliable information.

The standby altimeter and airspeed indicator are combined in one instrument. They are connected to the auxiliary pitot and alternate static systems, and do not require electrical power to perform their intended function; electrical power is required for the vibrator that prevents the pointers from sticking.

Primary power for the two standby instruments' integral lights (STI1-8) was being supplied by the 115 V AC Bus 1 (phase B) circuit breaker (CB) B-523 (labelled MAIN & PED INSTR PNL LTG) located on the lower main CB panel at position A-13. The wiring for the primary electrical power circuit integral lights runs below the cockpit floor and not through any area where heat damage[28] was observed; therefore, there is no reason to suspect that these lights ceased to function. Back-up electrical power for the integral lights was supplied by the left emergency AC bus.

A direct-reading, standby magnetic compass (see Figure 11) is installed in the cockpit forward of the overhead panel on the windshield centre post. The instrument does not require electrical power to operate. Electrical power for lighting of the compass (STI1-9) was supplied by the 28 V direct current (DC) Bus 1. The switch for the compass light is on the overhead switch panel, near the compass. The standby compass is normally kept in a stowed position with the light off. As is the case with all direct-reading magnetic compasses, the accuracy of the instrument in the MD-11 is degraded when the aircraft is accelerating or decelerating, and when the aircraft is not in straight and level flight.


[28]     Heat damage is defined as damage caused by exposure to significantly elevated temperatures. This includes charring, melting, shrinkage, and discolouration of materials due to heat.

Previous | Next

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

1.6.9  Communications Systems

  1. 1.6.9.1 - General
  2. 1.6.9.2 - Interphone Call System
  3. 1.6.9.3 - Aircraft Communications Addressing and Reporting System

1.6.9.1  General (STI1-10)

For external communications, Swissair MD-11 aircraft are equipped with five separate radios, plus an emergency hand-held very high-frequency (VHF) radio stored in a bracket mounted on the cockpit rear wall. The five radios comprise three VHF radios and two high-frequency (HF) radios, all of which are controlled through communication radio panels installed in the aft pedestal between the two pilots seats.

Internal voice communication between the pilots is either spoken directly or through boom microphones attached to headsets. Each flight crew oxygen mask has a built-in microphone that is activated with a push-to-talk rocker switch. One position of the rocker switch is used for internal communication, and the other position is used for transmitting over the external VHF and HF radios. Additional internal communication is provided through a flight interphone system that connects all cabin attendant stations and the cockpit, and a passenger address (PA) system that enables the pilots and cabin crew to address passengers throughout the cabin and in the lavatories.

The ambient noise in the MD-11 during high-altitude cruise flight is low enough so that pilots typically do not need to use the headsets and boom microphones for internal communications. Swissair policy requires flight crews to use this equipment for flight below 15 000 feet. There are regulatory requirements in some jurisdictions that mandate the use of this equipment below certain altitudes. For example, US FAR part 121.359 (g) mandate their use below 18 000 feet for aircraft equipped to record the uninterrupted audio signal received by a boom or mask microphone in accordance with FAR part 25.1457 (c)(5). Canadian Aviation Regulations (CARs) (CAR 625.33 II (5) refers) require their use below 10 000 feet.

1.6.9.2  Interphone Call System (STI1-11)

The aircraft was equipped with an interphone call system to facilitate aircraft crew communication. In Swissair MD-11s, handsets, call buttons, and reset switches are installed at nine stations throughout the aircraft: one in the cockpit and one at each flight attendant station. Calls can be initiated from any flight attendant station to the cockpit; from the cockpit to any, or all, flight attendant stations; and from any flight attendant station to any, or all other, flight attendant stations.

The interphone call system provides both aural and visual signals to alert crew members to a station call. A visual alert is provided by the illumination of indicating lights in the reset switches. In the passenger cabin there is an additional visual alert through the use of pink call lights. At the associated area master call display, these lights would illuminate to indicate the initiation of a "pilot-to-flight-attendant" or "flight-attendant-to-flight-attendant" call. When the call button is pushed, two electro-mechanical chimes, one above the left and one above the right attendant station emit a single-stroke chime.

All cabin interphone conversations are recorded on a single cockpit voice recorder (CVR) channel. The CVR recording does not indicate which station is being used.

1.6.9.3  Aircraft Communications Addressing and Reporting System

The occurrence aircraft was equipped with an aircraft communications addressing and reporting system (ACARS), which is a two-way digital communications link between the aircraft and the operator's flight operations centres. Typically, when the aircraft is within VHF radio range of a ground station the ACARS uses the aircraft's VHF 3 radio to communicate through a network system. (STI1-12)

The ACARS switches automatically to communicate through a satellite communications (SATCOM) system (STI1-13) when the aircraft is out of range of VHF ground stations, VHF coverage is interrupted through saturation of the system, or the VHF 3 radio in the aircraft is switched to voice mode. When VHF coverage is available, VHF is the primary path for data exchange. The SATCOM system also provides satellite telephone service available to all aircraft occupants.

The ACARS provides a means to automatically report flight information, such as engine parameters and load data, and to track aircraft movements, such as take-off and landing times. The pilots can also use the ACARS to obtain information, such as weather reports, and to exchange free-text messages.

Swissair's main service provider for the ACARS was Société Internationale de Télécommunications Aéronautiques (SITA). All communications to and from the aircraft through SITA were routed through the SITA Swissair host in Zurich. Where SITA was not able to maintain coverage, they subcontracted to Aeronautical Radio Inc. (ARINC), which is the main service provider in the USA, and to the International Maritime Satellite Organization (INMARSAT) for satellite coverage.

Previous | Next

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

1.6.10  Electrical System

  1. 1.6.10.1 - General
  2. 1.6.10.2 - Air-Driven Generator
  3. 1.6.10.3 - Emergency Electrical Power Isolation
  4. 1.6.10.4 - Cockpit Circuit Breaker Panels
  5. 1.6.10.5 - Overhead Circuit Breaker Panel Bus Feed Wires
  6. 1.6.10.6 - Upper and Lower Avionics Circuit Breaker Panel Bus Feed Wires
  7. 1.6.10.7 - Upper and Lower Main CB Panel Bus Feeds
  8. 1.6.10.8 - Wire Identification, Location, and Routing
  9. 1.6.10.9 - Wire Description – MD-11 Aircraft

1.6.10.1  General

Normal primary electrical power is generated by three, engine-driven, integrated-drive generators (IDG). An auxiliary power unit (APU) generator is also available as a back-up source of electrical power in certain ground or flight phases. The three IDGs supply electrical power to their respective generator buses,[29] which in turn supply electrical power to several sub-buses located throughout the aircraft. Electrical power distribution is normally automatic; however, if necessary, the pilots can control the electrical system manually with controls located on the overhead switch panel. (STI1-14)

The following definitions are used throughout the report. They are based on the Society of Automotive Engineers' (SAE) Aerospace Standard AS50881, Rev. A, entitled Wiring, Aerospace Vehicle:

  • Wire: A single metallic conductor of solid, stranded, or tinsel construction designed to carry current in an electric circuit, but not having a metallic covering, sheath, or shield. For the purpose of this report, "wire" refers to "insulated electric conductor."
  • Cable: Two or more wires contained in a common covering, or two or more wires twisted or moulded together without a common covering, or one wire with a metallic covering shield or outer conductor.
  • Wire bundle: Any number of wires or cables routed and supported together along some distance within the aircraft.
  • American Wire Gauge (AWG): A standard set of non-ferrous wire conductor sizes. "Gauge" is based on diameter. The higher the gauge number, the smaller the diameter and the thinner the wire.

1.6.10.2  Air-Driven Generator (STI1-15)

The ADG is an air-powered turbine that drives an electrical generator. The ADG is manually deployed via a lever in the cockpit; once deployed, it cannot be retracted in flight. The ADG is located on the lower right-hand side of the fuselage to the right of the nose gear doors.

When deployed, the ADG automatically supplies hydraulic power for the flight controls by electrically powering auxiliary Hydraulic Pump 1. With a switch on the electrical system control panel (SCP), the pilots can switch the ADG to an electrical mode of operation. In doing so, the ADG supplies emergency electrical power that operates instruments and communication equipment. In this configuration, electrical power is no longer supplied to auxiliary Hydraulic Pump 1; in the absence of primary power, the pump will cease to operate.

On the occurrence aircraft, the ADG was stowed at the time of impact. There would have been no requirement to deploy the ADG unless electrical or hydraulic power or both were unavailable from other sources. Information derived from the examination of various system components indicates that, at the time of impact, electrical and hydraulic power were available from sources other than the ADG.

1.6.10.3  Emergency Electrical Power Isolation

For the purpose of isolating a source of smoke, electrical power can be shed in sequence from the electrical buses through the four-position SMOKE ELEC/AIR selector located on the overhead electrical control switch panel (see Figure 11). This selector allows for the isolation of electrical or air conditioning systems that could be the source of fumes or smoke.

The selector must be pushed in and rotated clockwise to move it to the next position. The selector cannot be turned counter-clockwise. As the selector is rotated, electrical power is returned to the systems associated with the previous position prior to shutting off electrical power associated with the new selector position. If the selector is rotated through to the NORM position, all electrical power from the three generator systems is returned, and the three air systems are restored.

1.6.10.4  Cockpit Circuit Breaker Panels

There are nine separate CB panels in the cockpit; the five most pertinent to this investigation are the overhead CB panel, the upper and lower avionics CB panels, and the upper and lower main CB panels (see Figure 12). The remaining four are the captain's and first officer's console CB panels, the centre overhead integral lighting CB panel, and the lower maintenance CB panel.

The overhead CB panel contains wiring from the following six separate buses:

  • 28 V DC battery bus;
  • 28 V DC battery direct bus;
  • left and right emergency AC buses; and
  • left and right emergency DC buses.[30]

The upper avionics CB panel contains wiring from the following seven separate buses:

  • 115 V AC buses 1 and 3;
  • 28 V DC buses 1 and 3; and
  • 28 V AC 1, 2, and 3 instrument buses.

The lower avionics CB panel contains wiring from the following two separate buses:

  • 28 V DC Bus 2; and
  • 28 V DC ground bus system.

The 28 V DC ground bus system CBs, installed on the lower avionics CB panel, were all 0.5 ampere (A) CBs used for indication and control of their respective remote control CBs. The 28 V DC Bus 2 consisted of three, 3 A and one, 5 A CBs. A jumper wire from the line side of the "SLAT CONTROL PWR B" CB, which was a 3 A CB, was used to provide 28 V DC to a 1 A CB used to power the IFEN control relays. The four, 115 V AC three-phase power supply 15 A CBs for the IFEN were installed in the lower avionics CB panel.

The upper and lower main CB panels contain wiring from both the 115 V AC and 28 V DC buses 1, 2, and 3.

The standard used by the aircraft manufacturer for CB identification was to identify each row by a letter, and each column by a number. This methodology was used to identify the location of individual CBs on the panel.

1.6.10.5  Overhead Circuit Breaker Panel Bus Feed Wires

These bus feed wires were routed through five conduits that were installed along the right side of the fuselage, from the avionics compartment to approximately halfway up the fuselage side wall. In the cockpit, outside of the conduits, the bus feed wires were individually clamped to wire support brackets that were attached to the aircraft structure by nylon standoffs. The individual wires were bundled together, just prior to entering the right side of the overhead CB panel. Table 7 describes the bus feeds.

Table 7: Overhead CB Panel Bus Feeds

Bus Feed Right Emergency AC Bus, Phases A, B, and C 28 V DC Battery Direct and Battery Buses Left Emergency AC Bus Right Emergency DC Bus Left Emergency DC Bus
Wire harness number ABS9208 ABS9206 ABS9205 ABS9206 ABS9205
Wire run letter ALB ALN ALC ALP ALE
Wire size 3 – #8AWG 1 – #8AWG 1 – #6AWG 1 – #10AWG 1 – #6AWG 1 – #6AWG
Function 115 V right emergency AC bus, Phases A, B, and C 28 V DC battery direct and battery buses 115 V left emergency AC bus 28 V right emergency DC bus 28 V left emergency DC bus

1.6.10.6  Upper and Lower Avionics Circuit Breaker Panel Bus Feed Wires

The 115 V AC bus feeds originate in the Centre Accessory Compartment and the 28 V DC bus feeds originate from the avionics compartment. The three 28 V AC instrument bus feed wires originate from instrument transformers that are mounted on the aft face of the cockpit wall. Primary electrical power to these transformers is supplied from the lower main CB panel 115 V AC buses 1, 2, and 3 respectively.

All of the bus feed wires supplying the avionics CB panel are routed from the right aft side of the cockpit wall, forward through a hole behind Galley 2, and then inboard to the avionics CB bus bars.

The HF Comm 1 requires a three-phase electrical power source to operate. As a result, two additional 115 V AC Bus 1 feed wires (phases B and C) are routed to the HF Comm 1 CB. Similarly, an additional DC Bus 2 feed wire is routed to two CBs: the AFCS MISC PNL LIGHTS and the PRIMARY HOR STAB TRIM. Table 8 describes the main bus feed wires and their run letters.

Table 8: Avionics Bus Feed Wires and Run Letters

Function 115 V AC
Bus 1
115 V AC
Bus 3
28 V DC
Bus 1
28 V DC
Bus 3
28 V AC
Instr – 1
28 V AC
Instr – 2
28 V AC
Instr – 3
Wire Number B110-7-8A B110-22-8A B117-3-8 B117-1-8 B108-5-16 B108-7-16 B107-9-16
Wire Run Letter AEU AEV ASD ASE ASC ASC ASC

1.6.10.7  Upper and Lower Main CB Panel Bus Feeds

The upper and lower main CB panels receive electrical power from bus feed wires that are routed from the avionics compartment located below the floor; these bus feed wires were not routed through any area where heat damage was observed.

1.6.10.8  Wire Identification, Location, and Routing

All McDonnell Douglas–installed wires in the MD-11 are identified by a wire number consisting of an alpha character followed by a numeric string (e.g., B203-974-24). The alpha character designates the aircraft section in which the wire is installed (see Section 1.6.1.3). The six digits that follow identify the individual wire number; the final two digits identify the wire gauge. Therefore, wire B203-974-24 indicates that the wire is installed in the B section, that its individual wire number is 203-974, and that it is a 24 AWG wire. An N suffix indicates a ground wire.

Typically, wires that are installed in aircraft are tied together in bundles called wire runs. Therefore, individual wires can be further referenced by identifying the wire run in which they are included.

In the MD-11, every wire run is identified by a three-letter designator, such as "FBC," which provides information about where and how the wire run is routed through the aircraft.

  • The first letter indicates the location of the wire run in the aircraft. Letters A, B, C, R, Q, and S are used for the cockpit and nose area. Letters D, E, and H refer to the fuselage section below the floor. Letters F, G, and J refer to the cabin above the floor. The letter K identifies the right wing. The letter L identifies the left wing. Letters T and V identify the tail location.
  • The second letter indicates whether the wire run is enclosed in a conduit or in an open wire bundle. The letters V, W, Y, and Z are used if the wire run is in a conduit; all other letters indicate an open wire bundle. The second letter also indicates the applicable RF interference category of the wires in the bundle.
  • The third letter identifies the specific run.

Where practical, the wire number is directly marked on the outer insulation of each wire; otherwise, the wire number is affixed to the wire by tags at both the start and termination points. A wire may need multiple sets of run letters to completely describe its routing through the aircraft.

Once a wire number is known, it is possible to use the manufacturer's wire list to determine where the wire is installed in the aircraft. The wire list also provides information about the wire's composition, length, to-and-from termination points, circuit function, and wire run affiliation.

1.6.10.9  Wire Description – MD-11 Aircraft

1.6.10.9.1  Selection Criteria for Wires – Douglas Aircraft Company

In accordance with FAR 25.869, the only certification test required for aircraft wires is the 60-degree Bunsen burner test (see Section 1.14.1.2). Aircraft manufacturers typically perform additional wire tests to meet manufacturing and customer requirements, and select wire types based on a balance between the characteristics of the wire types available and the required application.

In 1976, Douglas Aircraft Company (Douglas) was informed by its wire supplier that the general purpose wire they were providing for the wide body aircraft program was going to be discontinued. Douglas initiated a wire evaluation program to select a new general purpose wire. The review included an assessment of various wire insulation types with respect to their electrical, mechanical, chemical, and thermal properties, along with their inherent flame resistance and smoke production characteristics. The evaluation resulted in two types of insulation being selected: a modified cross-linked ethylene-tetrafluoroethylene (XL-ETFE)[31] in accordance with Douglas specification BXS7008 and an aromatic polyimide,[32] hereinafter referred to as polyimide, in accordance with Douglas specification BXS7007.

Polyimide insulation was viewed as having favourable weight and volume characteristics. Also, it offers superior resistance to abrasion, cut-through, and fire. Polyimide does not flame or support combustion. The limitations of polyimide included less resistance to arc tracking[33) and less flexibility than other insulation types. Polyimide insulation is an amber-coloured film that is wrapped on the wire. In some cases, a modified aromatic polyimide resin coating was applied over the polyimide film to provide a suitable topcoat surface to allow the wire identification number to be directly marked on the wire. This topcoat appears dull yellow in colour.

In 1975, the FAA issued a Notice of Proposed Rulemaking (NPRM)[34] stating that for wire, the specific optical density[35] requirement for smoke emission would be a value of 15 (maximum) within 20 minutes after the start of the test. Although this NPRM was expected to be adopted, it was terminated without affecting the existing rules. However, before the NPRM was terminated, Douglas testing showed that the polyimide insulation would pass the specific optical density test requirements and that the XL-ETFE would not.

Based on cost and other considerations, Douglas chose XL-ETFE for its BXS7008 general purpose wire insulation, and used XL-ETFE in the DC-10. At the same time, polyimide insulation in accordance with BXS7007 was selected for the pressurized passenger section primarily because it produced less smoke when exposed to heat or flame compared to XL-ETFE. Polyimide could also be used in special applications, such as in locations where the temperature exceeded 150°C (302°F), whereas XL-ETFE was not rated for such temperatures.

In the early 1980s, a crimping problem was discovered with wires that had XL-ETFE insulation and tin-coated copper conductors. Because of this, Douglas decided to switch to nickel-coated conductors, even though they were more expensive. Subsequently, XL-ETFE lost its cost advantage, and Douglas switched to polyimide-insulated, nickel-coated conductors for all its general purpose wire.

In 1991, a US Air Force wire evaluation program identified a suitable general purpose wire replacement. It was a composite insulation made from polytetrafluoroethylene-polyimide-polytetrafluoroethylene (PTFE-PI-PTFE). That same year, Douglas initiated another wire evaluation program, using the polyimide general purpose wire as its baseline for comparison testing of other wire insulations types. The testing showed that the PTFE-PI-PTFE insulation performed as well as or exceeded the polyimide insulation; Douglas selected the PTFE-PI-PTFE insulation, in accordance with DMS 2426, for its general purpose wire in 1995.

Table 9 shows the comparative properties of four wire insulations.

Table 9: Comparative Properties of Wire Insulation Systems[36]

Relative Ranking Most Desirable -------- to -------- Least Desirable
1 2 3 4
Weight PIa ETFEb COMPc PTFEd
Temperature PTFE COMP PI ETFE
Abrasion resistance PI ETFE COMP PTFE
Cut-through resistance PI COMP ETFE PTFE
Chemical resistance PTFE ETFE COMP PI
Flammability PTFE COMP PI ETFE
Smoke generation PI COMP PTFE ETFE
Flexibility PTFE ETFE COMP PI
Creep[37] (at temperature) PI COMP PTFE ETFE
Arc propagation (arc tracking) resistance PTFE ETFE COMP PI
  1. PI – MIL-W-81381/7 (aromatic polyimide)
  2. ETFE – MIL-W-22759/16
  3. COMP – MIL-W-22759/80-92 (PTFE-PI-PTFE)
  4. PTFE – MIL-W-22759/80-92

1.6.10.9.2  MD-11 Wire Specification

Douglas identified the following two general purpose wire specifications for the MD-11: BXS7007 and BXS7008 (see Figure 13). These wire specifications adopt by reference, unless otherwise indicated, certain government-furnished documents, including Military Specifications and Standards and Federal and Industry Standards, as well as certain Douglas Material and Process Specifications. BXS7007 and BXS7008 also establish performance and test requirements that the wires must meet in addition to those adopted from the referenced documents, including, for example, the 60-degree burn test required by FAR 25.869.

BXS7007 specification is entitled "Wire, Electric, Copper & Copper Alloy, Polyimide Tape Insulated, 600 Volt." This specification covers wires and cables that must pass all the applicable performance and test requirements for the specified gauges as defined in MIL-W-81381, MIL-W-81381/12, and MIL-W-81381/14, as well as MIL-W-27500 and other referenced documents, unless otherwise indicated in the specification. Douglas started using the BXS7007 wire in production aircraft in 1980.

Wires that conform to BXS7007[38] are polyimide insulated with nickel-plated conductors. All BXS7007 wire conforms to the requirements of MIL-W-81381/12 (in addition to other applicable requirements), except for 24 AWG wire, which is high-strength alloy that conforms to the requirements of MIL-W-81381/14 (in addition to other applicable requirements). All BXS7007 wire is rated at 200C, 600 volts. The temperature rating refers to the maximum temperature in which the wire may be used, and is derived by combining ambient and wire-generated heating.

BXS7008 specification is entitled "Wire, Electric, General Purpose, Copper & Copper Alloy, Fluoropolymer Insulated."[39] This specification covers wires and cables that must pass all the applicable performance and test requirements for the specified gauges as defined in MIL-W-22759, MIL-W-22759/34, and MIL-W-22759/42, as well as MIL-W-27500 and other referenced documents, unless otherwise indicated in the specification (see Figure 13). Douglas started using the BXS7008 wires in production aircraft in 1977.

Wires that conform to BXS7008 are insulated with modified, XL-ETFE. BXS7008 requires that the insulation be applied or extruded on the conductor in two layers of contrasting colour to aid in the identification of insulation damage. Wires 22-00 gauges are tin-coated copper. These wires must conform to MIL-W-22759/34 and are rated at 150°C, 600 volts. BXS7008 24 gauge wire is nickel-coated high-strength copper alloy. This wire must conform to MIL-W-22759/42 and is rated at 200°C, and 600 volts.

MIL-W-27500, which is one of the documents adopted in both BXS7007 and BXS7008 unless otherwise indicated, covers requirements for special purpose cables and electrical power cables, including the basic wire size and type, number of wires, and shield and jacket styles. BXS7007 and BXS7008 also adopt documents requiring identification coding of wires.

In the areas of SR 111 where the fire occurred, it is estimated that more than 95 per cent of the wiring installed at the time of manufacture was BXS7007 (i.e., polyimide insulated wire). Douglas also used various other types of wire, in small amounts, where a specific requirement existed.


[29]    An electrical bus is a power distribution point to which a number of circuits may be connected. It can consist of a solid metal strip in which a number of terminals are installed, or a section of wire.

[30]    The report refers to the left and right emergency 28 V direct current (DC) buses as left and right emergency DC buses respectively.

[31]    XL-ETFE is produced by first modifying and then irradiating ethylene-tetrafluoroethylene.

[32]    Polyimide-type insulation is frequently known by the trade name Kapton®, when manufactured by the DuPont Company; or Apical®, when manufactured by Kaneka High Tech Materials Inc.

[33]    The Federal Aviation Administration's (FAA) Advisory Circular (AC) 25-16 Electrical Fault and Fire Prevention and Protection dated 5 April 1991 defines arc tracking as a phenomenon in which a conductive carbon path is formed across an insulating surface. This carbon path provides a short-circuit path through which current can flow. This phenomenon normally occurs as a result of electrical arcing and is known variously as carbon, wet, or dry arc tracking.

[34]    Federal Register, Vol. 40, No. 30, 12 February 1975.

[35]    Specific optical density is a dimensionless measure of the amount of smoke produced per unit area by a material when burned.

[36]    Table originally created by DuPont.

[37]    Creep occurs over time when a plastic part or object is subjected to a load. High temperature can accentuate creep.

[38]    In this report, BXS7007 specification wires are referred to as polyimide.

[39]    The fluoropolymer insulation under MIL-W-22759 suffixes other than "/34" and "/42" may be polytetrafluoroethylene, fluorinated ethylene-propylene, polyvinylidene fluoride (PVF2), unmodified ethylene-tetrafluoroethylene, or other fluoropolymer resin. The fluoropolymer may be used alone or in combination with other insulation materials.

Previous | Next

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

1.6.11  In-Flight Entertainment Network

  1. 1.6.11.1 - Description
  2. 1.6.11.2 - Wiring Installation
  3. 1.6.11.3 - Components

1.6.11.1  Description (STI1-16)

The IFEN system combined computer, video, and audio technologies to allow passengers to select movies, audio, games, news, gambling, and the moving map display through an interactive seat video display. The IFEN was to be configured to give all passengers access to a variety of "on-demand" entertainment and information choices, with touch-screen control. The original design, for the Swissair MD-11, provided full IFEN access to 257 passenger seats, which included all cabin classes; however, only the first two aircraft were configured to have the IFEN available in all 257 seats. For economic reasons, in April 1997, Swissair decided to reduce the IFEN configuration to include only first- and business-class seats.

The IFEN system was installed in the first- and business-class passenger sections of HB-IWF between 21 August and 9 September 1997 (see Figure 14). Although the 49 business-class seats were installed at that time, because of delivery delays, the 12 IFEN-equipped first-class seats were not installed until February 1998. The economy-class passenger section was not configured with the IFEN, even though electrical cabling and equipment rack supports were installed for that section. HB-IWF was the eighth Swissair MD-11 to be equipped with the IFEN system. (STI1-17)

1.6.11.2  Wiring Installation

The IFEN system, as configured in HB-IWF, required 4.4 kilovolt-amperes of 115 V AC three-phase 400 hertz aircraft power according to the Hollingsead International (HI) electrical load analysis (ELA) 20032 revision (Rev) B. The main power supply cable for the IFEN system consisted of three 8 AWG, MIL-DTL-16878/5-BNL wires twisted together. This cable originated at an electrical terminal strip located in the avionics compartment and was terminated at a 15 A three-phase CB located on the lower avionics CB panel (see Figure 14 and Figure 15). This 15 A CB, identified as "RACK1 PS1," provided aircraft power by means of jumper wires[40] to three adjacent 15 A three-phase CBs located on the lower avionics CB panel. Each of these four 15 A CBs provided aircraft power to one of the four IFEN power supply units (PSU). The PSUs used a series of capacitors and internal electronics to convert the 115 V AC aircraft system power to 48 V DC output power, used by the IFEN system components.

Each of the four 15 A IFEN CBs was connected to its respective PSU by one of four PSU cable assemblies, hereinafter referred to as PSU cables; each PSU cable consisted of three 12 AWG, MIL-W-22759/16/12 wires twisted together.

Additionally, a 1 A CB was installed on the lower avionics CB panel. The CB provided 28 V DC power, by means of a 16 AWG wire (hereinafter referred to as 16 AWG control wire), to the IFEN relay assembly located in the ceiling above Galley 8. This 1 A CB, identified as "IFT/VES 28V," received 28 V DC aircraft power by means of a jumper wire from the line side of the adjacent CB, "SLAT CONTROL PWR B," and was used to control the 48 V DC output of the four PSUs through the IFEN relay assembly. Pulling this CB removed the 48 V DC output power from the PSUs; however, pulling the CB would not remove the 115 V AC input power to the PSUs.

The four IFEN PSU cables (PSU 1, 2, 3, 4) and the 16 AWG control wire were routed rearward along the lower avionics CB panel. In this area, they were attached to the main IFEN power supply cable with nylon self-locking cable ties. This IFEN wire bundle was then cable tied to the DC CB ground bus bar at the lower avionics CB panel and, in some installations, held in place near the rear of the panel by a clamp. The wire bundle was then directed upward until it separated in two directions. The main power supply cable looped downward, passing through a conduit along the right side of the fuselage into the avionics compartment. The four PSU cables and the 16 AWG control wire, now in their own bundle, continued upward as a single bundle near the avionics disconnect panel.

Following the SR 111 occurrence, the IFEN installation was examined in 15 Swissair MD-11s. It was noted that the routing of the bundle containing the PSU cables and the 16 AWG control wire varied among aircraft behind the avionics CB panel. None of these variations were considered to affect the immediate safety of flight. There were differences in how frequently this bundle was supported by any of the three horizontally mounted wire support brackets available, and in the methods used for fastening it to the brackets. Also, some installations had protective sleeving installed adjacent to the brackets, while others did not.

Near the avionics disconnect panel, the IFEN wire bundle was routed aft into one of the 102-cm (40-inch) long conduits that were installed above Galley 2 (see Figure 4 and Figure 5). In 11 of the examined Swissair MD-11s, the wire bundle was routed to pass in front of the avionics disconnect panel, and in three of those 11 installations, the bundles were then routed through the outboard conduit. In 4 of the examined aircraft, the bundle was not routed in front of the avionics disconnect panel; instead, it was routed close to the cockpit wall. In 2 of the 4 installations, the bundle was then routed through the outboard conduit. In total, 5 of the aircraft had the IFEN wire bundle routed through the outboard conduit, and 10 had the bundle routed through the middle conduit.

In the occurrence aircraft, it could not be determined from the IFEN installation documentation how the IFEN wire bundle had been routed in the area of the disconnect panel, or which conduit had been used in the area above Galley 2. The IFEN installers preferred to use the middle conduit where possible, but in the five instances noted above, the middle conduit was not available as it had been used for aircraft wiring. In the sequence of IFEN installations, the middle conduit had been used in the three aircraft prior to HB-IWF, and also in the seven aircraft following HB-IWF.

The investigation was not able to establish from the manufacturer's records which conduit might have been left unused in HB-IWF (SN 48448). In the aircraft built immediately before HB-IWF (HB-IWE – SN 48477), the middle conduit was used for the IFEN wire bundle. In the next Swissair aircraft built after HB-IWF (HB-IWG – SN 48452), the outboard conduit was used for the IFEN wire bundle.

The conduit material, based on DMS 2024 Revision B, was Type 1, convoluted, thin wall, fluorinated ethylene-propylene (FEP). The installation of the wire bundle, from where it exited the aft end of the conduit to approximately STA 515, also varied between aircraft. The wire bundle was found to be routed either above or below the upper horizontal angle support bracket for the R1 door ramp deflector, above or below the wire supports, and was clamped to either the top or bottom of these supports or to existing aircraft wiring. Where the IFEN cables were attached to existing wire harnesses, spacers were installed to provide separation between the wire bundles. Additionally, some of the aircraft had protective sleeving installed over the wire bundle in the area near the R1 door ramp deflector upper support.

The wire bundle continued rearward until the PSU 1 and 2 cables were separated from the bundle and terminated at an IFEN electronics rack (E-rack) 1. E-rack 1 was located in first class above the right aisle, with its forward support located at STA 647.

The 16 AWG control wire continued rearward, then crossed over the aircraft crown at approximately STA 750, and was terminated at the relay assembly mounted above Galley 8. This relay assembly received all of the external interfaces to the aircraft system including the following: the decompression signal, which removed power from the IFEN if the aircraft became depressurized; the PA system override signal, which was designed to stop all audio and video on the IFEN system whenever the PA was used; and the 28 V DC power input supplied by the "IFT/VES 28V" 1 A CB. Removal or loss of this 28 V DC power caused an "On/Off" relay, located within the relay assembly, to disable the output of all the PSUs.

The PSU 3 and 4 cables continued rearward until crossing over the aircraft crown at STA 1239. They were then routed rearward along the left side of the fuselage and terminated at E-rack 2. E-rack 2 was located in economy class above the left aisle, with its forward support located at STA 1429.

1.6.11.2.1  Wire Description

The primary wire type selected for the IFEN system installation was MIL-W-22759/16, an extruded ethylene-tetrafluoroethylene (ETFE) copolymer insulation, medium weight, tin-coated copper conductor, rated at 150°C, 600 volts. (See Figure 13.) Additionally, the wires used for the main power supply cable were MIL-DTL-16878, an extruded polytetrafluoroethylene (PTFE) insulation, copper-coated copper conductor, rated at 200°C, 1 000 volts. The MIL-W-22759/16 wire had a maximum temperature rating of 150°C.

The 28 V DC wire, from the 1 A CB in the lower avionics CB panel to the IFEN system relay assembly, was specified as 16 AWG MIL-W-22759/16.

Each IFEN PSU power cable consisted of three, 12 AWG, MIL-W-22759/16 wires twisted together. For circuit identification purposes, MIL-C-27500 specification required the wires for each cable to be coloured white, blue, and orange. The cable was to be labelled using identification markers as called out in an HI drawing.

The main IFEN power supply cable consisted of three, 8 AWG, MIL-DTL-16878/5-BNL wires twisted together as called out in an HI drawing. This drawing also stated that the wire will not be identified by printed marking on the outside of the wire. MIL-DTL-16878/5-BNL specifies an extruded PTFE, maximum rating of 200°C, 1 000 volts. For circuit identification purposes, MIL-C-27500 specification required the wires for each cable to be coloured white, blue, and orange. However, a red wire was substituted for the blue wire in the installation, which had no affect on the performance of the wire. Samples of each 8 AWG coloured wire were analyzed by Fourier Transform Infrared Spectroscopy and identified as PTFE with a melting point of 323°C; this was determined by differential scanning calorimetry.

1.6.11.3  Components (STI1-18)

E-rack 1 contained the following components (see Figure 14):

  • PSUs 1 and 2 that supplied 48 V DC power to CB Unit 1, which distributed 48 V DC power to the components mounted in E-rack 1;
  • Two electromagnetic interference (EMI) filter boxes, one attached to each PSU. The filters were connected between the power supply input and the PSU, and were designed to filter out conducted EMI from the aircraft power supply;
  • Two 32-channel modulators, which converted the baseband video and audio input signals to broadband RF output signals;
  • A video on demand (VOD), which extracted, selected, and distributed the movie/music data;
  • A disk array unit, which stored the digitally encoded programming;
  • A 13-channel modulator, which performed the same function as the 32-channel modulator, as well as distributed common video/audio information, such as the moving map system, to the entire aircraft;
  • Two head-end distribution units, which combined the separate modulator outputs then split the output four ways; and
  • Six cluster controllers, which coordinated all the computer network administrative tasks.

The VOD was also equipped with a removable disc pack to permit maintenance personnel to upload movies.

E-rack 2 contained the following:

  • PSUs 3 and 4 that supplied 48 V DC power to CB Unit 2, which distributed 48 V DC power to the components mounted in E-rack 2;
  • EMI filters 3 and 4; and
  • A network switching unit, which provided network links for the IFEN administrative network.

Each first- and business-class seat was equipped with an interactive video seat display that included a touch screen and magnetic card reader; a seat electronics box, which processed all information for the passenger interface; and a dual audio/game-port, which controlled the games and audio. In addition, each set of first- and business-class seats was equipped with a seat disconnect unit, which contained the tuner and network repeater.

A cabin file server, located on a rack in Galley 8, controlled the download of movies, stored flight/casino information, and collected the credit card data transmitted from each seat. Galleys 1 and 8 were fitted with a management video display (MVD). The MVD provided an interface for cabin crew and maintenance personnel, and served as a point of control for configuring, maintaining, and monitoring the IFEN. Each MVD was equipped with a management terminal electronic box, the primary functional component interface to the IFEN by the flight crew and maintenance personnel. A printer was also located in Galley 8.


[40]    The jumper wire was a single wire that was installed between common terminals of two circuit breakers.

Previous | Next

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

1.6.12  Aircraft Fire Protection System

  1. 1.6.12.1 - General
  2. 1.6.12.2 - Portable Fire Extinguishers
  3. 1.6.12.3 - Engine/APU/Cargo and Lavatory Fire Extinguisher Bottles

1.6.12.1  General (STI1-19)

While no zone of an aircraft is immune to in-flight fires, fire protection systems used in transport category aircraft have evolved based on the probability of fire ignition within particular zones of the aircraft. These aircraft are equipped with a variety of built-in detectors and, in some cases, associated suppression systems designed to assist the aircraft crew in identifying and extinguishing an in-flight fire. In accordance with FAA airworthiness certification requirements, the occurrence aircraft was equipped with built-in fire detection and suppression capabilities in the aircraft's designated fire zones (see Figure 2). FAR 25.1181 states that a designated fire zone includes engines, APUs, and any fuel-burning heater or combustion equipment. In addition, specific regions of the aircraft, such as cargo compartments and lavatories, have been identified as "potential fire zones"[41] that require various built-in detection and suppression capabilities.

The fire risk to the remainder of the pressure vessel was such that it did not have, nor was it required to have, built-in detection and suppression equipment. Therefore, the remaining zones of the aircraft were solely dependent on human intervention for both detection and suppression of an in-flight fire. For the purposes of this report, the remaining zones of the aircraft for which built-in detection and suppression are not specified are referred to as "non-specified fire zones."

1.6.12.2  Portable Fire Extinguishers

The aircraft was equipped with eight portable fire extinguishers, which were held by brackets mounted in designated locations and distributed throughout the aircraft. In the passenger cabin there were five, 2.5-pound (lb) bromochlorodifluoromethane (Halon 1211) fire extinguishers, and two 5-lb monoammonium phosphate (dry chemical) fire extinguishers. The cockpit contained one 2.5-lb Halon 1211 fire extinguisher held by a bracket mounted on the cockpit rear wall (see Figure 17).

Five of the six Halon 1211 extinguishers, and both dry chemical fire extinguishers, were recovered. (STI1-20) It was not possible to determine where these extinguishers had originally been located in the aircraft, primarily because each extinguisher was identical in design, and there were no additional identifying features. Three Halon extinguishers exhibited markings indicating that they were still in their mounting brackets at the time of impact. Two of the three extinguishers still contained a charge of fire extinguishing agent. The pre-impact charge state of the remaining Halon 1211 extinguishers could not be determined, owing to punctures and other damage incurred at the time of impact.

One of the two dry chemical extinguishers showed marks indicating that it was in its mounting bracket at the time of impact. Its charge state at the time of impact could not be determined. The other dry chemical extinguisher was charged at the time of impact, with its locking pin intact; it could not be determined whether this extinguisher was in its mounting bracket at the time of impact.

1.6.12.3  Engine/APU/Cargo and Lavatory Fire Extinguisher Bottles (STI1-21)

The aircraft was equipped with nine fire extinguishing bottles, containing bromotrifluoromethane (Halon 1301) in the engine, the APU, and cargo areas. Eight of the nine bottles were recovered. Fire handles, which control the activation of the engine fire bottles, were installed on the overhead panel in the cockpit. (See Figure 11.) When the fire handle is pulled and turned, electrically activated explosive cartridges rupture a frangible disc and the extinguishing agent is released from the bottles. The APU bottle is activated automatically when a fire occurs in the APU compartment. The cargo fire bottles are activated by push buttons in the cockpit.

There is no indication that any of these engine/APU/cargo fire extinguishing bottles were discharged by flight crew actions, although some bottles showed signs that they had been discharged by the explosive cartridges, most likely at the time of impact.

A total of four lavatory fire extinguishers were recovered; none could be identified as to its installed location. There was no soot or heat damage on any of the extinguishers. From the recorded information, there was no indication that any of the smoke detectors in the lavatories activated.


[41]    The Transportation Safety Board of Canada (TSB) defines a "potential fire zone" as a region of the aircraft in which the identified risk of fire, by the regulatory authority, mandates an appropriate measure of built-in detection and suppression.

Previous | Next

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

1.6.13  Flight Control System

  1. 1.6.13.1 - General
  2. 1.6.13.2 - Longitudinal Stability Augmentation System
  3. 1.6.13.3 - Flaps and Slats

1.6.13.1  General (STI1-22)

The MD-11 has a conventional flight control column and rudder pedal configuration for the captain and first officer. The primary flight control system comprises the inboard and outboard elevators, the inboard and outboard ailerons, and one upper and one lower rudder. The secondary flight control system comprises the inboard and outboard wing flaps and slats, the wing spoilers/speed brakes, and a controllable horizontal stabilizer. (STI1-23)

All primary and secondary flight control surfaces are hydraulically powered by two aircraft hydraulic systems. Flight control positions are displayed, normally by DU 4, on the SD by selecting the configuration page with the CONFIG cue switch on the SDCP. In addition to the SD, flap and slat positions are also shown on the PFD. Alerts will appear on the EAD and the SD.

Other than the slats, which are electrically controlled and hydraulically actuated, the flight control system is designed with a direct mechanical/hydraulic interface consisting of cables that run between the cockpit controls and the various hydraulic actuators that move the control surfaces. Therefore, with the exception of the slats, the movement of the control surfaces does not depend on the availability of electric power.

1.6.13.2  Longitudinal Stability Augmentation System

The MD-11 incorporates a longitudinal stability augmentation system (LSAS) that enhances longitudinal stability through commands to the elevators in a series mode. The LSAS holds the existing pitch attitude of the aircraft whenever the sum of the captain's and first officer's column forces is less than two pounds. In the software version that was installed in the occurrence aircraft, below 15 000 feet, there is no LSAS input when the column force is above two pounds. Above 15 000 feet, the LSAS provides an additional pitch rate damping input when the control column force is above two pounds. Automatic pitch trim of the horizontal stabilizer is also operative in the LSAS mode.

The LSAS is inoperative whenever the autopilot is engaged or when the aircraft is below 100 feet above ground level (agl). With the LSAS inoperative and automatic pitch trim unavailable, manual pitch trim is available.

As part of the investigation, simulator flights were conducted below 15 000 feet to gain an appreciation of the flyability of the MD-11 with the LSAS inoperative. There were no noticeable controllability changes in the pitch control or flyability of the aircraft with the LSAS inoperative.

1.6.13.3  Flaps and Slats (STI1-24)

The flaps and slats are controlled by the FLAP/SLAT lever on the right-hand side of the cockpit centre pedestal. In normal operation, as part of the climb-out check, the pilots would pre-select 15 degrees of flap on the DIAL-A-FLAP wheel located on the right-hand side of the FLAP/SLAT lever. When the flaps are selected down they extend to the pre-selected setting (in the case of SR 111, 15 degrees); the slats normally extend whenever the flaps are extended.

At the time of impact, the flaps were extended to about 15 degrees, and the slats were retracted. The slat system incorporates overspeed protection, which prevents the slats from extending whenever the aircraft's speed is above 280 knots and the flaps are extended less than 10 degrees. The slat overspeed protection can also be overridden by selecting a flap extension of 10 degrees or more. The slat-extend function can also be overridden by pushing a SLAT STOW button, which is used in the event of either a slat disagree alert or the loss of hydraulic systems 1 and 3. There is no indication that either of these events occurred on the accident flight. The failure of the slats to extend was most likely the result of fire damage that led to an interruption in the electrical power supply to the slat control valves.

Previous | Next

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

1.6.14  Fuel System

  1. 1.6.14.1 - General
  2. 1.6.14.2 - Fuel Status at Departure
  3. 1.6.14.3 - MD-11 Fuel Dumping System

1.6.14.1  General (STI1-25)

The fuel is stored in three main tanks and two centre auxiliary tanks (upper and lower). The three main fuel tanks are located in the wings. Tank 1 (in the left wing) and Tank 3 (in the right wing) are identical, each having a main compartment, and an outboard compartment called the tip tank. Tank 2 is located in the inboard portion of each wing, and the two halves are interconnected by a large diameter fuel line to tanks 1 and 3. The two centre auxiliary tanks are located in the interspar fuselage section and are interconnected to the main tanks via a fuel manifold. The engines normally receive fuel, under pressure, from their respective main tank; the APU receives fuel from Tank 2. Because engines 1 and 3 are located below the wings, they can draw fuel from the fuel tanks even if the electric fuel pumps become inoperative. Engine 2, being tail-mounted and higher than the main fuel tanks, needs fuel to be pumped to the engine to maintain normal engine operation. In the event of a total electrical failure, fuel pressure to Engine 2 can be maintained by the Tank 2 left aft fuel pump and the tail tank alternate pump, both of which are powered by the right emergency AC bus following deployment of the ADG. The MD-11 is also equipped with a tail fuel tank, located in the horizontal stabilizer. During flight, fuel is automatically transferred in and out of this tank as required to maintain an aircraft C of G that aerodynamically provides the most economical fuel consumption. Every 30 minutes while the tail tank temperature is above 2°C, fuel is automatically transferred from the tail tank to Tank 2 or the upper auxiliary tank. On this particular flight, Tank 2 would have been the tank receiving the tail fuel.

There are seventeen, 115 V AC motor-driven boost or transfer fuel pumps interspersed among the various tanks. All of these pumps are electrically powered by one of the three generator buses; the Tank 2 left aft and the tail alternate pumps are powered from the right emergency AC bus, which receives power from the ADG if normal generator power is lost. All the pumps are automatically controlled throughout the flight by the fuel system controller (FSC) depending on the required fuel schedule, which includes fuel load, fuel distribution, phase of flight, fuel dumping, water purging, weight and balance control, and engine cross-feed operation requirements. The FSC checks and maintains the fuel schedule to satisfy structural load requirements and transfers fuel to the appropriate tanks to ensure proper distribution. The pumps can also be operated in MANUAL mode or, in certain failure conditions, the FSC may automatically revert to MANUAL mode. In the MANUAL mode, a selected set of fuel pumps will automatically turn on and can be controlled individually by a push button selection on the fuel SCP.

Three cross-feed valves can be used in the event of a fuel system delivery malfunction. In the event of an engine feed pump failure, the associated cross-feed valve can be opened to direct fuel to that engine. In the event of a main transfer-pump failure, fuel can be transferred using the engine feed boost pumps by opening the associated cross-feed valve.

The auxiliary tank fill/isolation valve works in conjunction with the tail tank fill/isolation valve when fuel is automatically transferred in and out of the tail tank for C of G control. Both valves are open when fuel is being transferred into the tail tank. When fuel is being transferred out of the tail tank, the tail tank fill/isolation valve is closed. Depending on flight conditions and the quantity of fuel in the upper auxiliary tank, the auxiliary tank fill/isolation valve is either open or closed. An open valve directs fuel to the three main tanks; a closed valve directs fuel to the upper auxiliary tank.

1.6.14.2  Fuel Status at Departure

After refuelling at JFK airport, the occurrence aircraft had a fuel load of 65 300 kg of Jet A fuel. The flight plan indicated that SR 111 would use 1 000 kg for taxi, leaving a fuel load at take-off of 64 300 kg.

1.6.14.3  MD-11 Fuel Dumping System (STI1-26)

The MD-11 has two fuel dump valves for dumping fuel overboard. There is one dump valve on the trailing edge of each wing, between the outboard aileron and outboard flap. Fuel dumping is initiated by selecting the DUMP switch on the fuel SCP in the cockpit. Selecting the DUMP switch activates the boost pumps, transfer pumps, and the cross-feed valves. The fuel dump rate is approximately 2 600 kg per minute, provided that all of the fuel pumps and both of the dump valves are functioning normally.

Fuel dumping will cease when the DUMP switch is selected again, when the aircraft gross weight reaches a weight that was pre-selected by the pilots through the FMS, or at any time the FUEL DUMP EMERGENCY STOP button is pushed. The FMS fuel dump default is set to the maximum landing weight of the aircraft: 199 580 kg. If a pre-selected weight is not set by the crew, fuel will be dumped until the aircraft weight reaches the default weight. Pilots do not normally pre-select a weight; they use the default setting as the desired dump weight. As a backup, each main fuel tank has low-level float switches that will stop fuel dumping from that tank when the fuel load in the tank reaches 5 200 kg.

Fuel dumping flow rates will be reduced if the SMOKE ELEC/AIR selector is selected while dumping is taking place. (STI1-27) Fuel dumping had not started prior to stoppage of the FDR recording, and fuel dumping was not underway at the time of impact. If the SMOKE ELEC/AIR selector was selected during the last few minutes of the flight, any associated reduction in fuel dumping rate would not have been a factor in this occurrence.

Previous | Next

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

1.6.15  Hydraulic System

Hydraulic power for the MD-11 is derived from three parallel, continuously pressurized systems. Each system is powered by two engine-driven hydraulic pumps. Different combinations of two of the three systems provide parallel power to each of the primary flight control actuators. Two back-up electrically driven hydraulic pumps are also available. If necessary, one of these pumps can be driven by electrical power from the ADG.

In the event of an in-flight engine shutdown, if the aircraft is in a take-off or land configuration (the flaps, slats, or landing gear are extended), hydraulic power is transferred automatically from an operating system to a non-operating system by reversible-motor pumps. In the cruise configuration, hydraulic power is not transferred.

During the investigation, various components of the hydraulic system were examined to determine whether any anomalies in the hydraulic system could have had an adverse effect on aircraft controllability. The shut-off valves associated with the reversible-motor pumps were found to have been closed at the time of impact when it would be expected that, given the configuration of the aircraft, at least one set of valves would have been open, allowing one of the reversible-motor pumps to operate. (STI1-28) Although the reason for the valves being in the closed position could not be determined, it could be attributed to several scenarios associated with fire-related electrical anomalies. (STI1-29)

Engine 2 was shut down by the pilots approximately one minute prior to the time of impact (see Section 1.12.9). The shutdown of Engine 2 and the loss of automatic hydraulic power transfer through a reversible-motor pump would have resulted in an eventual loss of, or reduction in, Hydraulic System 2 operating pressure. However, the functions of the primary flight controls operated by Hydraulic System 2 would have been picked up through a parallel operating system. Therefore, the anomaly would have had little or no adverse effect on aircraft controllability. (STI1-30)

Previous | Next

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

1.6.16  Cockpit Windows

The aircraft has six windows in the cockpit, three on each side. The two front windows are referred to as the left and right windshields. The windows immediately aft of the windshields are referred to as the left and right clearview windows; these can be manually opened under certain conditions. The two windows behind the clearview windows are referred to as the left and right aft windows.

All of the windows have imbedded electrical heating elements that are designed to prevent fogging on the inside of the window. The two windshields have additional electrical heating elements to prevent ice from forming on the outside. All of the windows have temperature sensors that allow the heating elements to be controlled from the windshield anti-ice panel located in the overhead control panel.

The controllers and sensors maintain the correct temperatures for anti-icing and defogging. The controllers automatically provide a gradual increase in heating to avoid thermal shock, and will remove electric power if an overheat condition occurs. An alert will be displayed on the EAD if any part of the system is not operative or if overheating occurs.

Previous | Next

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

1.6.17  Landing Gear (STI1-31)

The MD-11 has four landing gear assemblies: two main gear, a centre gear, and a nose gear. The two main landing gear retract inward; the centre main landing gear and the nose landing gear retract forward. The landing gear is hydraulically operated. Normal gear extension and retraction is provided by Hydraulic System 3.

All four landing gear assemblies were in the retracted position at the time of impact. The right main landing gear displayed greater overall damage than did the left main landing gear.

Previous | Next

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

1.6.18  Aircraft Interior Lighting

  1. 1.6.18.1 - Cockpit and Passenger Cabin Normal Lighting
  2. 1.6.18.2 - Emergency Lighting, Battery Packs, and Battery Charging System
  3. 1.6.18.3 - Flight Crew Reading Light (Map Light)

1.6.18.1  Cockpit and Passenger Cabin Normal Lighting

The MD-11 cockpit lighting includes overhead fluorescent lamps for area lighting, flood lights to illuminate the instrument panels, and integrally lighted panels. The cockpit also has supplemental lighting that includes flight crew reading lights (map lights), floor lights, and briefcase lights. The intensity of most of the lights can be controlled by rotary dimmer switches.

Lighting in the cabin includes overhead and side wall fluorescent light assemblies, as well as incandescent light assemblies that provide overhead aisle lighting and door entry lights. Cabin lights can be controlled from the cabin attendant stations.

1.6.18.2  Emergency Lighting, Battery Packs, and Battery Charging System

The MD-11 has an emergency lighting system that illuminates the cockpit and the cabin. The system includes ceiling lights in the cockpit, as well as overhead aisle lights, cabin door handle lights, exit sign lighting, and floor escape path lighting in the cabin.

The emergency lighting system consists of the lighting network and six battery packs, each with a battery charger and control logic that determines the power source. The system, including battery charging, is normally powered by the right emergency AC bus. If normal power is disrupted, the control logic is designed to switch first to the left emergency DC bus, and then if necessary, to the battery packs.

The batteries are on continuous charge whenever the EMER LT switch located in the cockpit is in the ARMED position and the EMER LT switch located at the left mid-cabin attendant station is in the OFF position. This is the normal in-flight switch configuration. Fully charged batteries will allow for about 15 minutes of emergency lighting.

The emergency lights can be turned on by using either the EMER LT switch in the cockpit, or the switch at the attendant station. The lights turn on automatically with a loss of power to the 115 V AC ground service bus.

The first item in the Swissair Smoke/Fumes of Unknown Origin Checklist (see Appendix C) calls for selecting the CABIN BUS switch to the OFF position. Doing so removes the electrical power from the cabin bus that supplies power to most of the cabin electrical services. If the EMER LT switch on the cockpit overhead panel is not switched to the ON position before moving the CABIN BUS switch to OFF, the cabin emergency lights will not automatically illuminate. In such a case, either the pilots or a cabin attendant would need to turn the EMER LT switch on to activate the emergency lights.

1.6.18.3  Flight Crew Reading Light (Map Light) (STI1-32)

The MD-11 cockpit has four map lights installed in the overhead ceiling area (see Figure 16). These lights provide additional illumination for the pilot and first officer positions, and for the left and right observers' stations. On the occurrence aircraft, the captain, first officer and right observer's station lights (PN 2LA005916-00) were manufactured by Hella KG Hueck & Co. (Hella). The left observer's light, PN 10-0113-3, was manufactured by Grimes Aerospace Co., and was a different design than the Hella light.

The Hella map light is designed to pivot up to 35 degrees from its vertical axis through 360 degrees. The light intensity is adjusted by turning the smaller diameter ring on the light head, which also serves as an ON/OFF switch. The size of the light beam, or area of illumination, is adjusted by turning the larger diameter ring on the light head. The map light was equipped with a 11.5 watt (W), 28 V DC tungsten halogen lamp.

The front of the map light is covered by a plastic ball cup; an insulating protective cap is installed on the rear of the light fixture. The protective cap is designed to insulate and protect the metal contact spring, which serves as the positive terminal that applies 28 V DC electrical power to the lamp base.

The Swissair MD-11 flight crew bunk module lights, PN 2LA 005 916-00 SWRA, were also manufactured by Hella. This bunk light was a map light that had been modified by removing the functionality of the ON/OFF switch to meet an FAA certification requirement. Although the bunk light used a different outer housing than the map light, the internal components were identical.

Previous | Next

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

1.6.19  Emergency Equipment

  1. 1.6.19.1 - Cockpit Emergency Equipment
  2. 1.6.19.2 - Cabin Emergency Equipment
  3. 1.6.19.3 - Flight Crew Oxygen
  4. 1.6.19.4 - Passenger Oxygen

1.6.19.1  Cockpit Emergency Equipment

The Swissair configuration of the MD-11 cockpit has four seats, with an oxygen mask dedicated to each seat position (see Figure 17). A rechargeable flashlight for each pilot is readily available from the seated position. Additional emergency equipment is stored on the cockpit rear wall behind the captain's seat; to retrieve this equipment, pilots have to leave their seats. The additional equipment includes a Halon 1211 fire extinguisher, fire gloves, two sets of portable protective breathing equipment (PBE), two additional flashlights, a crash axe, four life vests, and an emergency VHF radio transceiver. The emergency transceiver, which is normally stowed in the OFF position, is self-contained, battery operated, and pre-set to the international emergency frequency 121.5 MHz.

1.6.19.2  Cabin Emergency Equipment

The following emergency equipment is located in the cabin: seven fire extinguishers (five Halon 1211 and two dry chemical extinguishers) and fire glove sets, eight 310 litre (L) and two 120 L portable first-aid oxygen bottles (STI1-33) with masks, one crash axe, 14 flashlights, 11 sets of PBE, life vests for each passenger and flight attendant, medical kits, a megaphone, along with other miscellaneous items. In the skybunk flight crew rest areas there are two additional 120 L first-aid oxygen bottles, and two flashlights. In the cabin crew rest area there are an additional four 310 L oxygen bottles, one PBE, one Halon 1211 extinguisher, gloves, and a flashlight. (See also Section 1.6.12.2.)

1.6.19.3  Flight Crew Oxygen (STI1-34)

The Swissair MD-11 flight crew oxygen is supplied from one aluminum, high-pressure oxygen cylinder wrapped with a para-aramid fibre. The system delivers regulated oxygen through stainless steel lines to mask-mounted regulators, and supplies the captain, first officer, and the two observers' positions. A "T" fitting is installed in the stainless steel supply line near the crown of the aircraft, between STA 383 and STA 374, to provide an option for an additional crew mask in the freighter configuration. The "T" fitting is capped with an AN929-6 aluminum cap that, when installed, protrudes through the between-frame insulation blankets into the cockpit attic area (see Figure 5).

Each full-face mask assembly is stowed in a quick-access stowage box at each flight crew station, with the oxygen supply lines and microphone connections at the base of each stowage box (see Figure 11). When the oxygen mask stowage box door is opened, the mask microphone is automatically activated and the boom microphone deactivated.

The crew oxygen masks have a six-foot attachment line. Therefore, with the mask on, the captain can reach all of the emergency equipment, the cockpit door, and the overhead CB panels. The first officer would not be able to reach any of the emergency equipment, but can reach the cockpit door and the overhead CB panels. If conditions permitted, an option for the first officer would be to don an observer's oxygen mask; the hose length of either of these two oxygen masks would allow sufficient range of movement to reach the PBE and flashlights. The two portable PBEs each have a 15-minute supply of oxygen.

Each flight crew oxygen mask is fitted with a pneumatic harness, which is inflated by pressurized oxygen by manually actuating a lever on the regulator. When inflated, the harness allows easy donning and doffing of the mask, and fits easily over glasses and headsets. The harness deflates on release of the lever, tightening the mask to the wearer's face. The mask is equipped with a vent valve to purge any smoke from the goggles.

The mask-mounted regulators can function in one of three positions: normal diluter demand, 100 per cent oxygen, or emergency pressure breathing. The default position is normal diluter demand; 100 per cent oxygen or emergency pressure must be selected by the pilots. Such a selection would be made as warranted by the circumstances.

The SR 111 pilots were using oxygen for about 15 minutes. The charge state of the bottle at take-off was not determined; however, with both pilots using 100 per cent oxygen, the duration of the supply with a minimum dispatch pressure of 1 000 pounds per square inch (psi) would be at least 64 minutes. At 1 850 psi, which is a fully charged bottle, the duration would be about 119 minutes.

The crew oxygen cylinder pressure was last checked and the cylinder was refilled, on 9 August 1998, during an "A check." The cylinder was last hydrostatically tested on 17 March 1997. An examination of the crew oxygen cylinder showed that it was pressurized at the time of impact. During the time the CVR was recording, the pilots did not indicate having any problems with the oxygen system.

1.6.19.4  Passenger Oxygen

The MD-11 is fitted with independently mounted oxygen generators throughout the passenger and cabin crew areas. These generators supply oxygen masks that drop from compartments in the overhead panels. The masks are designed to be fitted over the nose and mouth. Once activated, each generator is capable of supplying a flow of oxygen to the masks that it serves for a minimum of 15 minutes.

The passenger cabin masks are stored behind module doors above the seats. The doors are held closed by electrically operated latches. The latches are powered by the 115 V AC buses 1, 2, and 3. If the cabin pressure decreases below a value equivalent to the standard pressure at 14 400 feet, the latches release and the doors fall open, allowing the masks to drop. The doors can also be selected open by the pilots through a switch in the cockpit.

The occurrence aircraft was equipped with 148 oxygen generators. (STI1-35) There were three sizes of oxygen generators installed; each served either two, three, or four masks. A total of 118 oxygen generators were recovered. Of the 83 examined in detail, (STI1-36) 53 were determined to have activated because of the impact. It was determined that none of the oxygen generators that were examined contributed to the fire, and that the passenger oxygen masks were not in use during the flight. (STI1-37)

The Swissair MD-11 Aircraft Operations Manual (AOM) warns that passenger oxygen masks must not be released below a cabin altitude of 14 000 feet when smoke or an abnormal heat source is present, as the oxygen may increase the possibility or severity of a cabin fire. As is typical with passenger oxygen masks in general use in transport category aircraft, the passenger masks in the MD-11 were designed to provide a mix of oxygen and ambient air. Therefore, the use of the masks would not have prevented passengers from inhaling smoke if it were present.

Previous | Next

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

1.6.20  Powerplants

  1. 1.6.20.1 - General
  2. 1.6.20.2 - Full-Authority Digital Electronic Controls

1.6.20.1  General (STI1-38)

The occurrence MD-11 aircraft was equipped with three Pratt & Whitney model 4462 engines. The engines are referred to by number: Engine 1 mounted under the left wing, Engine 2 mounted in the vertical stabilizer (tail), and Engine 3 under the right wing.

The aircraft is also equipped with an APU mounted in the tail section. The APU on the occurrence aircraft was not used by the pilots before the stoppage of the FDR, and it was not operating at the time of impact.

1.6.20.2  Full-Authority Digital Electronic Controls (STI1-39)

The engine thrust for each engine is controlled by a dual-channel (channels A and B) FADEC that interfaces with the aircraft and engine control systems. Each channel is independently capable of controlling engine operation. Electrical power to each FADEC is supplied primarily by an engine-driven permanent magnet alternator. Each FADEC can also be powered, if necessary, by the aircraft electrical system, through a supplemental control unit (SCU); this was an optional feature installed on this aircraft. This method of powering the FADEC using the SCU is referred to as back-up power. The FADEC also receives inputs from the engine throttle resolvers located below the central pedestal and linked to the throttle levers. There are two throttle resolvers per throttle lever. One resolver provides throttle resolver angle (TRA) input to Channel A and the second to Channel B. Electrical excitation for the resolvers is provided by the FADEC.

Each FADEC channel (A and B) also receives information from three digital data buses. Two of the buses supply data from the ADCs and the other supplies data from the FCCs. FCC-1 provides data to Channel A and FCC-2 provides data to Channel B. The ADCs provide pressure altitude, fan inlet total pressure (Pt2)[42] and total air temperature (Tt2)[43] to channels A and B. The FCCs provide EPR trim, engine bleeds, Weight-On-Wheel (nose gear compressed), and "flaps/slats retracted" information.

Each FADEC channel includes non-volatile memory (NVM) that records fault information used for maintenance scheduling and troubleshooting. There are 192 continuously available NVM fault cells. Each fault is registered only one time per flight leg, but is rewritten to memory when the engine is shut down with the engine FUEL switch. The contents of the fault memory will typically span many flights. The information in these memory cells is retained until all 192 NVM cells have been filled with information, at which time the information begins to be overwritten from the beginning.

Certain faults will cause the engine to revert from the normal EPR mode to the soft reversionary N1 mode of operation. This reversion will also cause the autothrottles to disconnect. Autothrottle cannot be re-engaged if any engine is in the N1 mode. Loss of TRA input will cause the engine to go to a fixed thrust that cannot be altered through the throttle control levers.


[42]    Pt2 refers to total pressure at compressor inlet (Station 2).

[43]    Tt2 refers to total temperature of the air at the compressor inlet (Station 2). Total temperature of a moving gas is the static temperature plus the temperature rise resulting from ram effect (kinetic energy caused by air in motion).

Previous | Next

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

1.6.21  Landing Performance

Landing distances at various aircraft weights were calculated to determine whether the occurrence aircraft could have stopped safely on Runway 06 at the Halifax International Airport. Calculations were completed for the occurrence aircraft with all systems operating normally, and with certain technical malfunctions.

The horizontal distance necessary to land an aircraft and come to a stop on a level, smooth, dry, hard-surfaced runway is called the landing distance. This distance is based on the aircraft being in the landing configuration on a stabilized landing approach at a height of 50 feet (15 m) above the landing surface (usually the runway threshold). For normal operations at destination and alternate airports, regulations require that this full stop landing be accomplished within 60 per cent of the available runway length,[44] with spoilers, and anti-skid operative, but without use of thrust reversers.

The Swissair MD-11 AOM contains landing graphs that flight crew can use to calculate anticipated landing distances. These graphs provide landing information for 35-degree and 50-degree flap settings, predicated on aircraft landing weight, airport elevation, wind component, and runway surface conditions. For unscheduled landings, the regulations do not require any operational reserve or safety margin as would be included when calculating the runway length for normal operations (1.67 multiplied by the landing distance).

The atmospheric conditions that existed at the time of the occurrence for a landing on Runway 06 at the Halifax International Airport were taken into account. For situations where all aircraft systems are operating normally, the calculated landing distances for various weights are shown in Table 10.

Table 10: Calculated Landing Distance – All Systems Operating Normally

Aircraft Weight Flaps 35 Degrees Landing Flaps 50 Degrees Landing
199 580 kg 4 725 ft. 4 236 ft.
218 400 kg 5 118 ft. 4 725 ft.
230 000 kg 5 316 ft. 4 920 ft.

If certain technical malfunctions occur, additional horizontal stopping distance will be used by the aircraft; therefore, a correction factor would need to be applied to estimate these increased landing distances. The Swissair AOM lists correction factors that must be added to the landing distance for various possible malfunctions. As indicated in Section 1.6.13.3, the wreckage revealed that the slats were retracted; if the pilots were aware of this anomaly, they would be required to land the aircraft with 28 degrees of flap, which is the certified landing configuration with slats retracted. Also, fire damage to the upper avionics CB panel resulted in several systems failures being recorded before the flight recorders stopped. The ground sensing CB is located in the area adjacent to the systems that were recorded as faults. If the ground sensing circuit was compromised because of the fire, the aircraft, once on the runway, would not have auto ground spoilers or the brake anti-skid feature. These additional factors would need to be added to the calculated landing distance. The minimum landing distance the SR 111 aircraft would have required under conditions of no slats, inoperative spoilers, and anti-skid brakes is shown in Table 11.

If the flight crew were unable to select 28 degrees of flap and landed with 15 degrees of flap, the landing distances would increase by approximately 12 per cent, as shown in Table 11. If the flight crew were able to get the flaps to 50 degrees and decided to conduct a landing in this unconventional configuration, then the above landing distances would be reduced by approximately 10 per cent.

Table 11: Estimated Landing Distance – With Technical Malfunctions[45]

Aircraft Weight Flaps 15 Degrees,
Slats Retracted,
Anti-skid System
Inoperative,
Auto Ground Spoilers
Not Available
Flaps 28 Degrees,
Slats Retracted,
Anti-skid System
Inoperative,
Auto Ground Spoilers
Not Available
Flaps 50 Degrees,
Slats Retracted,
Anti-skid System
Inoperative,
Auto Ground Spoilers
Not Available
199 580 kg 10 700 ft. 9 600 ft. 8 700 ft.
218 400 kg 11 800 ft. 10 600 ft. 9 500 ft.
230 000 kg 12 400 ft. 11 100 ft. 10 000 ft.

A caution in the AOM landing graphs states that for every 5 knots above the ideal approach speed, the landing distance will increase by 1 000 feet. The SR 111 flight crew was dealing with smoke and fire in the cockpit and failed aircraft systems and displays, and at some point was flying on standby instruments. Therefore, it is likely that the aircraft would not have been at the ideal position and speed for landing over the threshold, which could further increase the landing stopping distance. Thrust reversers, if available, would reduce this distance slightly.

Considering all of the factors, the SR 111 landing would likely have required more runway than the 8 800 feet available on Runway 06 at the Halifax International Airport.


[44]    The remaining 40 per cent of runway length is known as operational reserve or safety margin.

[45]    The certified procedure for landing if slats are retracted is to land with flaps at 28 degrees. The landing distance graphs do not provide correction factors with slats retracted for flap settings of 15 degrees or 50 degrees; therefore, these calculations are approximations and are provided for illustration only.

Previous | Next

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

1.6.22  Aircraft Maintenance Records and Inspection

  1. 1.6.22.1 - General
  2. 1.6.22.2 - Maintenance Records
  3. 1.6.22.3 - Maintenance Inspections
  4. 1.6.22.4 - MD-11 Service Information
  5. 1.6.22.5 - MD-11 Service Difficulty Reports
  6. 1.6.22.6 - MD-11 Maintenance Management

1.6.22.1  General (STI1-40)

The Maintenance System Approval Statement contained in Swissair's Air Operator Certificate (AOC) 1017 stated that Swissair was approved under Joint Aviation Requirements (JAR)-OPS 1, Subpart M, to manage the maintenance of its MD-11 aircraft. At the time of the occurrence, Swissair had contracted all aircraft maintenance to SR Technics, and Swissair had no in-house maintenance capability. As a JAR/FAR 145–approved repair station, SR Technics was contracted to perform all aircraft maintenance defect rectification, maintenance checks beyond the pre-flight, maintenance engineering activities, maintenance planning, and spare parts handling in support of Swissair's operations.

1.6.22.2  Maintenance Records

During the investigation, a review was conducted of Swissair/SR Technics' maintenance program, record-keeping procedures, and the occurrence aircraft's maintenance records. A small number of discrepancies were discovered regarding engineering orders (EO) and logbook entries. The discrepancies were considered minor, and the overall method of record-keeping was considered to be sound. The maintenance records kept for HB-IWF indicate that it was maintained in a manner commensurate with industry practices.

The review of the aircraft's maintenance records, which included the technical logbook entries from 10 September 1997 until 2 September 1998, the last three "A checks," and the IFEN System Maintenance Activity Review, did not identify any events that were considered relevant to the investigation.

1.6.22.3  Maintenance Inspections (STI1-41)

In addition to the maintenance checks carried out before every departure, Swissair MD-11s underwent a series of scheduled maintenance activities. These were accomplished at various flight hours (FH) as follows: "A check" every 700 FH; "C check" every 6 000 FH; and first "D check" at 30 000 FH or 72 months, whichever occurred first. The last scheduled maintenance activity carried out on the occurrence aircraft was an "A check" completed on 10 August 1998.

A review of HB-IWF's maintenance history verified that all requirements of the approved maintenance program were completed either on time, or within the tolerance granted to Swissair by the Swiss Federal Office for Civil Aviation (FOCA).

1.6.22.4  MD-11 Service Information

1.6.22.4.1  Service Bulletins (STI1-42)

Aircraft manufacturers and product vendors issue to users of their products, documents that are designed to improve the level of flight safety, to provide specific advice or instructions, or both. These documents include, but are not limited to, Service Bulletins (SB), Alert Service Bulletins (ASB), Service Letters, and All Operator Letters (AOL). The type of document issued depends upon the issuer's assessment of the urgency or severity of the information being presented; ASBs have the highest priority. Compliance with these documents is at the owner's or operator's discretion, as compliance is not mandatory unless an associated Airworthiness Directive (AD) is promulgated by the applicable regulatory authority.

At the time of the occurrence, there were 822 MD-11 SBs applicable by fuselage number to HB-IWF of which 51 were ASBs. Of the 51 ASBs, 47 were complied with, 2 were related to AD 94-10-03 for which an exemption was granted (see Section 1.6.22.4.2), 1 was underway, and 1 was specific to a water heater installation that was not installed in the Swissair fleet of MD-11s. The SR Technics engineering department reviewed each SB. If it determined that the SB warranted incorporation, they produced an EO. The determination to accept or reject an applicable SB was made by the cognizant engineer, and reviewed and approved by the cognizant engineer's manager.

A review of the aircraft manufacturer's MD-11 SBs issued up to the time of the accident identified 16 that were considered of interest to the investigation. Included in these were SBs related to events that could cause chafing, arcing, sparking, or smoke in the cabin or cockpit.

1.6.22.4.2   Airworthiness Directives (STI1-43)

An AD, typically based on either a manufacturer's or vendor's SB, is issued when an unsafe condition exists and that condition is likely to exist or develop in other products of the same type design. An AD is a regulatory directive mandating an inspection, repair, modification, or procedure issued either by the state of manufacture or by the CAA of the country in which the aircraft is registered.

The FOCA adopts and reissues each AD published by a state of manufacture pertaining to aircraft registered in Switzerland or with products that might be installed on Swiss-registered aircraft. Within SR Technics, the FOCA AD will only be distributed if it is not covered by an AD issued by the state of manufacture, or if there are deviations in the content. Swissair complied with all ADs issued by the state of manufacture, even if they were not legally binding for Swiss-registered aircraft under Swiss legislation.

At the time of the occurrence, 57 MD-11 ADs were issued by the FAA that were applicable to the occurrence aircraft. The SR Technics "Status List of Engineering Orders" verified that all applicable ADs had been accomplished, with the exception of AD 94-10-03, for which an exemption has been granted to Swissair by the FOCA. AD 94-10-03 addressed a potential software anomaly involving navigation equipment input to the FMC/FCC, and was therefore not deemed to be relevant to the circumstances of this occurrence. A review of the MD-11 ADs issued by the FAA up to the time of the accident identified the following two ADs that were potentially related to either the area of the fire damage in SR 111 (AD 93-04-01) or other smoke events in the cockpit (AD 97-10-12).

The subject of AD 93-04-01 was to "prevent display units from going blank, which could lead to momentary loss of flight critical display information." This AD took effect on 2 April 1993 and referred to ASB MD-11 A24-51, which took effect on 11 September 1992. SR Technics accomplished the AD on 14 January 1993 when the ASB was completed.

The subject of AD 97-10-12 was to "detect and correct chafing of the wire bundles adjacent to the avionics disconnect panel bracket assembly and consequent in-flight arcing behind the avionics CB panel, which could result in a fire in the wire bundles and smoke in the cockpit." This AD took effect on 16 June 1997 and referred to SB MD11-24-111, which took effect on 3 December 1996. SR Technics had accomplished this AD on HB-IWF on 6 March 1997.

1.6.22.5  MD-11 Service Difficulty Reports (STI1-44)

A search of the FAA's Service Difficulty Report (SDR) database for MD-11/11F entries, submitted until September 1998, revealed a total of 970 SDRs.[46] At that time, the MD-11/11F SDRs were reviewed using the keywords fire, smoke, and smell. Additionally, the same data was searched using the Air Transport Association (ATA) codes for communications (2300) system, power distribution (2400), and fire protection (2600) systems. This review revealed some general statistical information referred to in Section 1.18.10, but did not identify specific discrepancies relevant to the circumstances of this investigation. Detailed and specific information regarding wiring discrepancies was not consistently available as it was not required to be captured within the SDR database. There was no dedicated Joint Aircraft Systems/Components Inspection Code (enhanced ATA codes) used to collect, compile, and monitor data regarding wiring discrepancies. However, during the course of this investigation, on the basis of wiring data issues highlighted by National Transportation Safety Board (NTSB) investigations such as Trans World Airlines 800[47] and by industry group deliberations, the FAA requested that the ATA introduce a new ATA reporting code subchapter (97) to facilitate more accurate tracking of specific wire-related problems and anomalies.

1.6.22.6  MD-11 Maintenance Management

As with any commercial aircraft, the maintenance management of the MD-11 involved various companies and regulatory agencies. Beyond Swissair's maintenance obligations, as outlined in their AOC, SR Technics, the FOCA, the FAA, and Boeing all had either direct or indirect maintenance management commitments in support of Swissair's MD-11 fleet (see Section 1.17).


[46]    The FAA's Service Difficulty Report (SDR) system is designed to collect, analyze, record, and disseminate data concerning defects and malfunctions that have resulted in, or are likely to result in, a safety hazard to an aircraft or its occupants. Information contained in SDRs is submitted by the aviation community and is, for the most part, unverified.

[47]    See the National Transportation Safety Board report DCA96MA070 concerning the 17 July 1996 accident involving a Trans World Airlines Boeing 747-131 near East Moriches, New York.

Previous | Next

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada
Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

1.7.1  General (STI1-45)

Two active weather systems were in the area of the SR 111 flight track between New York to Halifax: a line of thunderstorms moving through the New York area; and Hurricane Danielle, which was located approximately 300 nm southeast of Halifax. The forecasted effects of both systems were moving in a predictable manner. Nova Scotia was under the influence of a weak ridge of high pressure and the distant effects of the hurricane.

Previous | Next

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

1.7.2  Forecast Weather

The aviation area forecast weather for the region including Peggy's Cove was as follows: 2 000 to 3 000 feet scattered, occasional broken cloud with the tops at 8 000 feet; 10 000 feet broken occasional overcast with the tops at 16 000 feet, high broken cloud, visibility greater than 6 statute miles (sm). (STI1-46)

The terminal aerodrome forecast (TAF) for Halifax Shearwater Airport, located between the Halifax International Airport and the crash site near Peggy's Cove, was as follows: surface wind 070 degrees True at 10 gusting to 20 knots; visibility greater than 6 sm; a few clouds at 500 feet agl; scattered clouds at 2 000 feet agl, broken clouds at 24 000 feet agl; temporarily from 2300 to 0200, 5 sm in light rain showers and mist; scattered clouds at 500 feet agl, broken clouds at 2 000 feet agl, and overcast at 10 000 feet agl.

The TAF for Halifax International Airport was as follows: surface wind 090 degrees True at 10 knots; visibility greater than 6 sm; scattered cloud layers at 3 000 feet agl, broken cloud at 8 000 feet agl, and broken cloud at 25 000 feet agl.

Previous | Next

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

1.7.3  Actual Reported Weather

The actual weather at JFK airport just prior to the departure of SR 111, was as follows: surface winds 170 degrees True at 12 knots; visibility 10 sm in thunderstorms and light rain; broken cloud at 2 200 feet agl, broken cloud at 4 000 feet agl consisting of cumulonimbus clouds, overcast layer at 9 000 feet agl; temperature 23°C; dew point 21°C; altimeter setting 29.73 inches of mercury (in. Hg). Remarks: thunderstorms in vicinity, west to northwest of the airport, moving eastward; thunderstorm began at 0010, rain began at 0003.

The weather at the Halifax Shearwater Airport at 0100 was as follows: surface winds 060 degrees True at 9 knots; visibility 15 sm; few clouds at 1 200 feet agl, broken clouds at 7 000 feet agl, overcast at 25 000 feet agl; temperature 18°C; dew point 15°C; altimeter setting 29.78 in. Hg; and cloud cover: stratus fractus 1/8, altocumulus 5/8, cirrus 3/8.

The weather at Halifax International Airport at 0100 was as follows: surface winds 100 degrees True at 10 knots; visibility 15 sm; broken cloud at 13 000 feet agl, overcast at 24 000 feet agl; temperature 17°C; dew point 13°C; and altimeter setting 29.80 in. Hg; and cloud cover: altocumulus 6/8, cirrostratus 2/8.

Between 0100 and 0200, the sky in the Peggy's Cove area was partially covered by clouds, and there were rain showers in the area. Visibility was recorded as "good" at weather stations on land; however, it was somewhat reduced in mist over the sea. The winds were blowing at about 10 knots. The air temperature was about 16°C.

Previous | Next

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

1.7.4  Upper Level Wind (STI1-47)

The wind at FL330 was from 210 degrees True at 65 knots, providing a ground speed for SR 111 of about 530 knots or nearly 9 nm per minute. The tailwind decreased during the descent, and diminished to about 13 knots from 200 degrees True at 10 000 feet.

Previous | Next

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

1.7.5  Weather Briefing (STI1-48)

Swissair flight operations officers in New York briefed the pilots and the flight planning was routine, the only exception being the selection of a more northerly track than normal. This route was chosen to avoid any adverse weather being generated by Hurricane Danielle. The weather briefing package received by the crew included, in part, forecasts for Boston, Bangor, and Halifax.

Previous | Next

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

1.7.6  Weather Conditions on Departure from JFK

At the time SR 111 departed from JFK airport, there was lightning associated with cumulonimbus clouds in the area, northwest and south of the airport. Within two minutes after take-off, the flight crew requested a heading deviation from the cleared track routing to avoid the isolated thunderstorms in that area. Cloud-to-ground lightning strike data indicated that the aircraft was more than 23 nm away from the closest ground strike and much farther away from the major ground lightning activity. Therefore, it is unlikely that the aircraft sustained a direct lightning strike from the cloud-to-ground lightning. (STI1-49)

The weather report at JFK airport included occasional lightning in cloud at the time of SR 111's departure, with isolated thunderstorms and cumulonimbus clouds in the vicinity. There was no reported lightning from cloud-to-cloud, only within the cloud. The thunderstorms were miles apart; therefore, it is unlikely that the aircraft intercepted a cloud-to-cloud lightning strike. (STI1-50)

The FDR showed no anomalies that might have indicated any unusual electrical disturbance within the aircraft during this period of time, and there was no recorded ATS communication to indicate that any lightning strike phenomena affected the aircraft. The available information indicates that the aircraft was not struck by lightning.

Previous | Next

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

1.7.7  Weather Conditions during Descent

SR 111 would have encountered several layers of cloud during its descent, placing the aircraft in instrument meteorological conditions. (STI1-51) The first layer of cloud was broken to overcast based at 24 000 to 25 000 feet. The aircraft would have likely entered a second layer of cloud at around 16 000 feet. The base of this layer was approximately 12 000 feet over the Halifax International Airport, sloping down to 7 000 feet over the Halifax Shearwater Airport.

As SR 111 proceeded north of the Peggy's Cove area at 10 000 feet, it is likely the aircraft was near the base of a cloud layer and may have temporarily been clear of cloud with good night flight visibility. As SR 111 headed south toward the ocean and began descending, it is likely that it would have entered a second layer of cloud. It would have entered a third layer at approximately 5 000 feet, and exited the layer no lower than 1 500 feet. Below 1 500 feet, the flight visibility was reported to be good and was likely unobstructed by cloud with the possibility of some light precipitation and fog over the water. When SR 111 was tracking toward the ocean, it would likely have been dark over the sea because of the cloud cover, mist, and lack of surface lights.

Previous | Next

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

1.8  Aids to Navigation (STI1-52)

All ground-based navigation aids in the Halifax area were recorded as serviceable at the time of the occurrence.

Previous | Next

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada
Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

1.9.1  General (STI1-53)

All recorded communications between SR 111 and the various air traffic control (ATC) units involved with the flight were of good technical quality; that is, all of the recording equipment functioned normally and the sound quality was up to the normal standard. All ground-based radio communications facilities related to the SR 111 flight were serviceable. Boston Air Route Traffic Control Center (ARTCC) experienced a 13-minute communications gap with SR 111, starting at 0033 and ending at about 0046. Information concerning the 13-minute communications gap is provided in sections 1.18.8.2.2 and 2.11 of this report. Other than this anomaly, no communications interruptions or discrepancies were reported by ATS or by any other aircraft along the route flown by SR 111 during the time of the flight.

Previous | Next

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

1.9.2  Controller Training

Nav Canada provides annual refresher training for controllers on relevant topics using basic lesson plans based on information in the Air Traffic Control Manual of Operations (ATC MANOPS) and other sources. The ATC MANOPS information on emergency procedures emphasizes air traffic separation responsibilities and administrative duties of controllers. In their aircraft emergencies training, controllers are expected to use their best judgment in handling situations not specifically covered, because it is impossible to detail procedures for all emergency situations. Information provided reminds controllers that "when an emergency occurs, time is of the essence, so all questions must be clear and concise. In order to respond effectively, the controller must rely on the information that the pilot provides." Throughout the occurrence, the controller took his lead from the pilot, believing that the pilot was the one who could best determine the nature of the situation in the aircraft, the nature of his requirements, and what he wanted the controller to do. Prior to this occurrence, controllers were provided basic training on how to respond to aircraft emergencies, but did not receive basic or continuation training on the flight and general operating requirements of aircraft in abnormal or emergency situations. In particular, controllers did not receive training on aircraft general operating procedures for fuel dumping and on basic indications they could expect from the aircraft.

Previous | Next

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

1.9.3  Transition Procedures and Controller Communications

The usual transition procedure for an aircraft in high-level airspace inbound to Halifax is to transition from a high-level en route air traffic controller to a low-level airspace controller, and then to a third controller responsible for traffic within the Halifax terminal control area. The airspace is controlled by the Moncton ACC, located in Riverview, New Brunswick. In this instance, the high-level en route controller coordinated with both the low-level controller and the Halifax terminal controller to reduce the number of RF changes required and to help expedite the descent. At 0118:16, the high-level en route controller instructed SR 111 to contact the Halifax terminal controller on frequency 119.2 MHz. Moncton ACC allocated one controller, with exclusive use of frequency 119.2 MHz, to meet the communications needs of SR 111 on approach to Halifax.

A detailed comparison was made between the transcript of the ATC transmissions and the recommended phraseology in the Nav Canada ATC MANOPS. Although there were occasional instances of minor omissions or substitutions, there was no indication that any of the advisories, clearances, or requests made by ATC were misunderstood or missed by the crew of SR 111. Similarly, the transmissions by the pilots of SR 111 were consistent with accepted industry standards and practices.

Previous | Next

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

1.9.4  Emergency Communications

When pilots transmit a message to indicate an abnormal situation or condition, the degree of danger or hazard determines the terminology to be used. A situation in which the safety of the aircraft or of a person on board is threatened, but that does not require immediate assistance, is a condition of urgency. The internationally recognized spoken expression for urgency is "Pan Pan," which is spoken three times in succession. A situation in which the safety of the aircraft or a person on board is threatened by grave and imminent danger, and that requires immediate assistance is a condition of distress. The internationally recognized spoken expression for distress is "Mayday," which is also spoken three times in succession. If the pilots already have the ATS controller's attention, it has become common practice for them to declare an "emergency," instead of using the term "Mayday." This practice is accepted within the aviation industry.

Nav Canada requires controllers to comply with the directives about emergency communication contained in the ATC MANOPS, Part 6, "Emergencies." Subpart 601 instructs controllers to provide assistance to the aircraft in distress, to use all available facilities and services, and to coordinate with concerned agencies. As well, the ATC MANOPS advises that controllers should keep flight crews accurately informed and exercise their best judgment in difficult situations.

The pilots of SR 111 and the controllers communicated in normal tones in all of their communications prior to the pilots declaration of an "emergency" situation. When the pilots declared an emergency at 0124:42, there was a slight elevation in their voices that reflected a higher sense of urgency. From the time of the Pan Pan call at 0114:15, the controllers at Moncton ACC treated the situation as they would treat an emergency; that is, they responded in the same way they would have had pilots made a Mayday call. Moncton ACC responded to the diversion situation, and their actions were in accordance with their standard practice.

Previous | Next

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

1.9.5  Air Traffic Services Communication Regarding Fuel Dumping

Fuel dumping information for Nav Canada air traffic controllers is contained in Part 7 of the ATC MANOPS. Section 701, "Fuel Dumping," instructs controllers to obtain information about the track, the time frame for dumping, and the in-flight weather conditions. As well, controllers are advised to encourage an aircraft to dump fuel on a constant heading over unpopulated areas and clear of heavy traffic. Controllers are also advised to restrict the altitude to a minimum of 2 000 feet above the highest obstacle within 5 nm of the track, and arrange for a warning to be broadcast frequently on ATC frequencies during the period of the fuel dump.

Additional fuel dump information for controllers in the Moncton ACC is contained in the Moncton ACC Operations Manual, 07-98. Section 3.20 identifies the preferred fuel dumping area for the Halifax area and instructs controllers to advise the appropriate flight service station (FSS) or stations.

After verifying with the pilots that a turn to the south was operationally acceptable to the crew, the controller chose a planned location for the SR 111 fuel dump, which was over St. Margaret's Bay, at an altitude above 3 000 feet. This location complied with ATS guidelines and would position the aircraft for a turn onto the on-course for the back-course approach to Runway 06.

When SR 111 advised the controller of the requirement to fly manually without further elaboration, the controller assumed that manual flight was a Swissair procedure to be followed during fuel dumping. When the pilots did not acknowledge the controller's clearance to commence fuel dumping, and when immediately thereafter the aircraft's Mode C transponder stopped providing data to the ATS radar, the controller interpreted this cessation of information from SR 111 to be the result of an electrical load-shedding procedure that Swissair used during fuel dumping operations. This interpretation was based on the controller's experience with military aircraft refuelling exercises carried out over Nova Scotia during which military fighter aircraft receiving fuel typically turned off unnecessary electronics, including the transponder.

Previous | Next

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

1.10  Aerodrome Information (STI1-54)

Halifax International Airport is 14 nm north-northeast of Halifax, at an airport elevation of 477 feet. ATC services for the Halifax airport are provided by radar controllers in the Moncton ACC and airport controllers in the Halifax ATC tower. The airport has runways oriented in two directions: Runway 15/33, which is 7 700 feet long; and Runway 06/24, which is 8 800 feet long. The runways are 200 feet wide and have an asphalt surface. The landing distance available for all the runways is equivalent to their full length.

Runways 24 and 15 are each served by an ILS approach; and runways 06 and 33 are each served by a localizer back-course approach. Runways 06 and 24 are also each served by an NDB approach. The NDB for Runway 06 is the Golf beacon, which is located on the extended centreline, 4.9 nm from the threshold of Runway 06.

Aircraft Firefighting Services at the Halifax International Airport met the availability and equipment requirements of the CARs. The Aircraft Firefighting Services were activated at 0120 and, within one minute, the response vehicles were in place adjacent to the runway of intended landing.

Previous | Next

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada
Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

1.11.1  General (STI1-55)

The occurrence aircraft was equipped with a digital FDR and a CVR. The FDR was an L3 Communications (Loral/Fairchild) model F-1000, which records about 250 parameters in solid state memory. (STI1-56) The recorder contained about 70 hours of continuous flight data, which included the accident flight, and the six previous flights. The FDR, as configured, did not record the parameters "Lavatory Smoke" and "Cabin (Cargo) Smoke." Nor did the FDR record any parameters related to the IFEN system. The data recorded on the FDR was of good technical quality.

The CVR was an L3 Communications (Loral/Fairchild) model 93-A100-81. (STI1-57) The recording medium was 1/4-inch tape on a continuous loop. The design provided for a nominal recording time of 30 minutes. The actual length of the CVR recording was 32 minutes, 24 seconds, starting at 0053:17 and stopping at 0125:41. The CVR recorded on four separate tracks: the output of each of the two pilot's audio management units (AMU); the cabin interphone or public address audio, whichever is selected; and the cockpit area microphone (CAM).

The CVR-recorded audio was of fair technical quality overall. Prior to when the pilots donned their oxygen masks, which incorporate a "hot" microphone[48] input to the pilot and co-pilot channels of the CVR, cockpit conversations were recorded only on the CAM channel. While in cruise flight, the pilots were not using their headsets, which incorporate integral boom microphones that provide better quality CVR recording than does the CAM. The industry norm is to not use the headsets while cruising at high altitude, and there was no regulation or company policy requiring them to do so. Despite extensive filtering attempts, some of the audio information recorded by the CAM on the CVR was difficult or impossible to decipher because of masking, either by the ambient cockpit noise, or by background ATS radio communications emanating from the cockpit speaker. The pilots' internal verbal communication was mostly in the Swiss–German language.


[48]    A hot microphone permits conversations to be heard continuously between the flight crew positions without any requirement to select an intercom switch.

Previous | Next

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

1.11.2  Recorder Installation Power Requirements

The CVR was powered by the 115 V right emergency AC bus and the FDR was powered by the 115 V AC Bus 3. Both buses are part of the 115 V AC Generator Bus 3 distribution system.

FAR 25.1457 (CVR), FAR 25.1459 (FDR), and the equivalent JARs, require that recorders be installed so that they receive power from the electrical bus that provides the maximum reliability for operation without jeopardizing service to essential services or emergency loads. Transport Canada's Canadian Aviation Regulations Standards Part V – Airworthiness Manual, Chapter 551, Articles 551.100 and 551.101 state that the FDRs and the CVRs shall be installed in accordance with the European Organisation for Civil Aviation Equipment (EUROCAE) documents ED-55 and ED-56A respectively. Additionally, the EUROCAE[49] references suggest that the FDR and the CVR be powered by separate sources.

Initially on the DC-10, the FDR was electrically powered by the 115 V AC Bus 3, and the CVR from 115 V AC Bus 1. However, for JAA certification, the CVR had to be powered by the 115 V right emergency AC bus, which is in turn powered by Generator Bus 3. As a result, both recorders were powered by the same source: Generator Bus 3. The MD-11 emergency checklist dealing with smoke/fumes of unknown origin requires the use of the SMOKE ELEC/AIR selector. This selector is used to cut power to each of the three electrical buses, in turn, to isolate the source of the smoke/fumes. The nature of this troubleshooting procedure requires that the selector remain in each position for an indeterminate amount of time, typically at least a few minutes. When the SMOKE ELEC/AIR selector is placed in the first (3/1 OFF) position, AC Generator Bus 3 is turned off, thereby simultaneously disabling the FDR and the CVR. With both the CVR and the FDR on the same generator bus, a failure of that bus, or the intentional disabling of the bus (e.g., as a result of checklist actions in a smoke situation), will result in both recorders losing power simultaneously.


[49]    The European Organisation for Civil Aviation Equipment prepares minimum performance specifications for airborne electronic equipment; however, these specifications remain as guidelines for consideration until mandated by regulatory authorities.

Previous | Next

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

1.11.3  Stoppage of Recorders (STI1-58)

Examination of various recovered aircraft system components show that the 115 V AC Generator Bus 3 was powered at the time of impact. On the base portion of the SMOKE ELEC/AIR selector that was recovered, there were indications that the selector was in the NORMAL position at the time of impact.

The CVR and the FDR both stopped because of the loss of electrical power during a 1-second time frame starting at 0125:41, which occurred 5 minutes, 37 seconds, before the aircraft struck the water. Two possibilities were examined to determine why the recorders stopped. The first was that the pilots selected the SMOKE ELEC/AIR selector to the 3/1 OFF position. The second was that a fire-related failure or failures led to the loss of electrical power to both recorders.

Selecting the SMOKE ELEC/AIR selector to the first position (3/1 OFF) would cause the two flight recorders to stop at exactly the same time, as the 115 V AC Generator Bus 3 is taken off-line.

The FDR data indicates that a brief power interruption to the digital flight data acquisition unit (DFDAU) occurred less than two seconds prior to FDR stoppage. This power interruption could not have been a result of selecting the SMOKE ELEC/AIR selector, as this would have resulted in an immediate shut down of the FDR and the CVR. A warm start re-initialization (reboot) of the DFDAU took place following the power interruption. The CVR also showed a discontinuity in recording within two seconds prior to CVR stoppage. These interruptions and discontinuities introduce variability in the relative timing between the two recordings and consequently in the precise relative stop times. It was possible to achieve a degree of time synchronization (less than one second between the CVR and the FDR). On the basis of time synchronization alone, it was not possible to determine whether the recorders stopped as a result of the SMOKE ELEC/AIR selector being selected to the 3/1 OFF position; other information was used to make this determination.

It is known that the pilots started the Smoke/Fumes of Unknown Origin Checklist by selecting the CABIN BUS switch to the OFF position. Prior to making that selection, the captain alerted the first officer about this action and received confirmation from him. The next action item in that checklist was the selection of the SMOKE ELEC/AIR selector. There are several indications that the flight recorders did not stop as a result of the use of the SMOKE ELEC/AIR selector. First, prior to the stoppage of the data recorders, the pilots made no mention of the SMOKE ELEC/AIR selector. Because the captain notified the first officer prior to selecting the CABIN BUS switch to the OFF position, the captain would likely have notified the first officer of his intention to move the SMOKE ELEC/AIR selector, as the first officer was the pilot flying and choosing the selector would have affected systems he was using. In addition, about 9 seconds after the flight recorders stopped, ATC began receiving Mode C (see Section 1.18.8.26) altitude data information from SR 111 for approximately 20 seconds. For this to have occurred, ADC-2, which is powered by the 115 V right emergency AC bus, had to be functioning. This bus would not have been powered if the SMOKE ELEC/AIR selector was in the first (3/1 OFF) position; therefore, it is very likely that this selector was in the NORM position when the recorders stopped recording.

Previous | Next

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

1.11.4  Lack of CVR Information

The CVR in the occurrence aircraft had a 30-minute recording capacity; this met the existing regulatory requirements. The requirements were predicated upon the technology available in the early 1960s, and 30 minutes represented the amount of recording tape that could reasonably be crash protected. Current technology easily accommodates increased CVR recording capacity. The majority of newly manufactured, solid-state memory CVRs have a two-hour recording capacity; however, regulations pertaining to HB-IWF at the time of the accident did not require more than the 30-minute CVR recording capacity.

The earliest information on the SR 111 CVR was recorded approximately 17 minutes before the unusual smell was detected by the pilots. Conversations and cockpit sounds prior to the beginning of the CVR recording would have been useful in looking for potential initiating or precursor events that led to the in-flight fire.

Aircraft electrical power to the SR 111 flight recorders was interrupted at about 10 000 feet, which resulted in the FDR and the CVR recording stoppage. The aircraft continued to fly for about 5.5 minutes with no information being recorded.

Modern, maintenance-free, independent power sources and new-technology CVRs make it feasible to provide independent CVR and CAM power for at least several minutes. This would allow the continued recording of the acoustic environment of the cockpit, including cockpit conversations and ambient noises, in the event of the loss of aircraft power sources.

Current battery technology would not provide sufficient independent power to allow for the same option for FDR information. The multiple sensors and wiring that feed information to the DFDAU require aircraft power.

Previous | Next

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

1.11.5  Quick Access Recorder (STI1-59)

Initiatives undertaken by airlines, such as the development and implementation of increasingly complex flight operational quality assurance programs, require that an increased number of data sets be recorded. Quick access recorders (QAR) were developed because information in FDRs was not easily accessible for routine maintenance and monitoring of aircraft systems. This type of recording has been done on QARs, which are not required by regulation. Most QARs in use routinely record far more data parameters, at higher resolution and sampling rates, than do FDRs.

Unlike FDRs, QARs are not designed to survive in a crash environment. From the numerous pieces of magnetic tape recovered from the aircraft wreckage, 21 individual segments were identified as likely being from the aircraft's QAR. Attempts were made to extract information from the QAR tape; however, it was not possible to extract meaningful information from any of the pieces.

The QAR installed on SR 111 had a tape-based cartridge that recorded approximately 1 400 parameters, which is about six times the number of parameters recorded on the FDR. The additional data recorded on the QAR included numerous inputs that could have been valuable to the investigation. Such information could have assisted in determining the serviceability of aircraft systems prior to, during, and after the initial detection of the unusual smell and subsequent smoke in the cockpit.

Investigative agencies have traditionally promoted the view that additional parameters should be added to those already recorded on FDRs. Typically, the recording capacity of FDRs has not been the limiting factor; rather, these initiatives have been tempered by the high costs of installing the necessary equipment into the aircraft, including the additional data sensors and associated wiring. An additional limiting factor has been the high cost of obtaining certification for the changed mandatory FDR data set.

Modern FDRs, which employ the same solid state memory technologies as modern QARs, make it technically feasible to capture the QAR information within the FDR in a crash-protected environment. However, current regulations do not require that this be done.

Previous | Next

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

4.2.1  Thermal Acoustic Insulation Materials

  1. 4.2.1.1 - Other Thermal Acoustic Insulation Materials at Risk
  2. 4.2.1.2 - Proposed Certification Standard for Thermal Acoustic Insulation Materials

4.2.1.1  Other Thermal Acoustic Insulation Materials at Risk

Since the beginning of this investigation, the aviation industry's understanding of the flammability characteristics of thermal acoustic insulation materials has advanced considerably. The recognition that MPET-covered insulation blankets are flammable and provided the main source of fuel in the SR 111 in-flight fire was significant. Extensive flammability testing determined that such blankets are susceptible to being ignited by small ignition sources, such as electrical arcing or sparking and will propagate a fire. Consequently, the FAA required that these blankets be removed from US-registered aircraft, and accelerated work to develop an improved flammability test for the certification of all thermal acoustic insulation materials.

Occurrence data confirms that some thermal acoustic insulation materials, other than MPET-covered insulation blankets, have been involved in aircraft fires that were ignited by electrical sources. FAA research revealed that these other thermal acoustic insulation materials, although more difficult to ignite, exhibit similar flammability characteristics once ignited. The flammability test that was used to certify all such materials (i.e., the vertical Bunsen burner test) was designed to determine whether the material would ignite from a small ignition source, such as an electrical arcing event, and extinguish within a predetermined flame time and burn length. All such materials were approved for use in aircraft because, once ignited, they self-extinguished within a predetermined flame time and burn length. The FAA's Radiant Panel Test (RPT) certifies materials using similar, albeit much more stringent, criteria.

The FAA has tested a representative sample of thermal acoustic insulation materials currently in use in the aviation industry and has determined that approximately two-thirds failed the RPT. Because the RPT effectively fails materials that could be ignited from a small ignition source, including an arc or spark, then potentially, these failed materials could exhibit such inappropriate characteristics while in-service. If the RPT is ultimately approved, any materials that fail the RPT would not be acceptable for use in any future aircraft manufacture or repair. However, unlike the case with MPET-covered insulation blankets, there is no indication that regulatory authorities will mandate a wholesale removal, from existing aircraft, of those other in-service thermal acoustic insulation materials that failed the RPT.

Additionally, since smoke generation and toxicity limits have never been established for thermal acoustic insulation materials, the associated risks have not been quantified. Such risks would likely be a factor if these flammable materials become involved in an in-flight fire. It has been suggested that, once the RPT is adopted, the "zero burn" feature of the RPT will result in the eventual elimination of flammable thermal acoustic insulation material in aircraft, and therefore, measuring a material's smoke generation and toxicity levels, as part of the certification process, is unnecessary. However, under the present approach, mitigation of the risks associated with these flammable materials will not be accomplished until the existing fleet of aircraft is replaced. Therefore, known flammable materials will exist for decades in thousands of aircraft worldwide.

The in-flight fire risks associated with MPET-covered insulation blankets have largely been mitigated. However, there are other thermal acoustic insulation materials that once ignited, exhibit similar flammability characteristics to MPET-covered insulation blankets, and have failed the RPT. Although these materials exist in many aircraft, as of this report's publication date, no mitigation strategy has been undertaken to address the known associated risks. Therefore, the Board recommends that:

Regulatory authorities quantify and mitigate the risks associated with in-service thermal acoustic insulation materials that have failed the Radiant Panel Test.
A03-01

Assessment/Reassessment Rating: Unsatisfactory

4.2.1.2  Proposed Certification Standard for Thermal Acoustic Insulation Materials

The FAA has proposed a rule that would replace the existing vertical Bunsen burner test with the RPT to evaluate fire ignition and propagation characteristics of all thermal acoustic insulation materials. During its validation of the RPT, the FAA reported that only 25 to 35 per cent of the various insulation blanket cover materials would pass the RPT. The proposed test has been widely accepted as a major improvement over the previous test in that it effectively imposes a "zero burn" criterion for all thermal acoustic insulation materials. Although the test would be required for all thermal acoustic insulation materials, and appears to be a better discriminator of materials that exhibit inappropriate flammability characteristics, the design of the RPT contains some inherent limitations.

The RPT is designed to expose the test specimen to a small fire-in-progress scenario that sets higher ignition and propagation threshold "pass" requirements. However, there are concerns about whether the current RPT suitably addresses the following key issues:

  • Although the FAA believes that a test specimen's orientation is an important factor in determining its propensity to be ignited and propagate a fire, the RPT only requires that a specimen be oriented horizontally;
  • The RPT has its origins in the American Society for Testing and Materials E648 test, which requires that the test specimen be pre-heated prior to the application of the flame. Although the FAA recognizes the benefits of pre-heating test specimens because of the deleterious effects on the thin-film covered thermal acoustic insulation materials, the RPT does not impose this pre-heat condition; and
  • The RPT requires the testing of three specimens that include all those materials used in the construction of insulation blankets (including batting, film, scrim, tape, etc.). However, it does not indicate how the flammability characteristics of the component materials are to be tested in the various permutations and combinations while only requiring that three specimens be tested.

Also, the Board is aware of initiatives by the FAA to design the RPT to account for potential degradation in the flammability characteristics of materials after they are exposed to their intended operating environment. The FAA has recognized that most aircraft in-service have insulation blankets with varying degrees of surface contamination, and that experience has shown that such contamination cannot be fully avoided. Therefore, one goal of the testing is to develop an appropriate evaluation procedure that can account for realistic in-service conditions.

Because the issues listed above are not addressed, it is unclear how the RPT would effectively identify all thermal acoustic insulation materials that may exhibit inappropriate flammability characteristics. Rather, it appears that the RPT is a single certification test for thermal acoustic insulation materials, which under certain conditions (such as conditions that do not involve pre-heating), results in an effective flammability test for thin-film-covered insulation blanket materials.

By developing the RPT, the FAA has successfully designed a single certification test that, while a major improvement over the vertical Bunsen burner test, may not successfully evaluate the performance of all types of thermal acoustic insulation materials under representative conditions. Given these limitations of the FAA's proposed RPT, the Board recommends that:

Regulatory authorities develop a test regime that will effectively prevent the certification of any thermal acoustic insulation materials that, based on realistic ignition scenarios, would sustain or propagate a fire.

A03-02

Assessment/Reassessment Rating: Satisfactory Intent

Previous | Next

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

4.2.2  Interpretation of Material Flammability Test Requirements

As a result of the investigation, the TSB previously issued three recommendations on the subject of Material Flammability Standards. Reaction to the content of these recommendations has been positive. Regulatory authorities have largely embraced the need for regulatory changes that would result in no materials being certified that would sustain or propagate a fire, as recommended in A01-02. The FAA is leading a research and development effort as part of the International Aircraft Materials Fire Test Working Group that is developing new flammability tests for materials, including wires and cables, found in "hidden areas." The Board believes that imposing more realistic and thus more severe flammability test requirements will serve to decrease the likelihood of flammable materials being approved for use in the manufacture or repair of aircraft. However, variations still remain in the interpretation and application of the regulations and guidance material.

Throughout this investigation, in an effort to determine the ignition and propagation scenario for the in-flight fire, various materials used in the manufacture of the MD-11 were tested in accordance with the applicable regulatory requirements. In some cases, materials such as silicone elastomeric end caps and hook-and-loop fasteners, demonstrated inappropriate flammability characteristics. Neither the aircraft manufacturer nor the regulatory authority were able to effectively explain whether these or other such materials had been required to be tested and, if so, could not produce a record of the resultant certification test data. It appears that varying interpretations of the same regulations may explain why some materials that were certified for use in aircraft met the flammability standards while others did not. As explained in the TSB's Material Flammability Standards recommendation package (issued August 2001), except for the most obvious and common materials, it was difficult to determine with certainty which flammability test(s) applied to which material. The applicable FARs could be misinterpreted so as to minimize the amount and level of testing required for certification of any particular material.

The certification of a newly manufactured aircraft is a complex endeavour, which includes the certification of many types of materials. The Board expected that as a result of its previous recommendations, regulatory authorities would not only develop improved testing but also simplify the interpretation of the regulations and guidance material so as to prevent the approval of flammable materials. Without such a concerted and focused effort, manufacturers and those responsible for the certification of aircraft materials will continue to operate in an environment where it is possible to misinterpret the regulatory requirements. In such circumstances, materials that exhibit inappropriate flammability characteristics can continue to be approved for use in aircraft. Therefore, the Board recommends that

Regulatory authorities take action to ensure the accurate and consistent interpretation of the regulations governing material flammability requirements for aircraft materials so as to prevent the use of any material with inappropriate flammability characteristics.
A03-03

Assessment/Reassessment Rating: Fully Satisfactory

Previous | Next

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

4.3.1  In-Flight Firefighting Measures

In December 2000, the TSB issued five recommendations that identified deficiencies associated with in-flight firefighting measures. Although the Board recognizes that improved material flammability certification tests will eventually result in a decreased threat, flammable materials will remain in many aircraft for decades. In addition, initiatives aimed at reducing potential ignition sources, such as improved CB, wire inspection methods, and maintenance procedures, while encouraging, will not eliminate all potential ignition sources. Consequently, the Board believes that continuing emphasis must be placed on ensuring that aircraft crews are adequately prepared and equipped to quickly detect, analyze and suppress any in-flight fire, including those that may occur in areas such as cockpits, avionics compartments, and hidden spaces.

The Board is encouraged that the deficiencies identified in its recommendation package of December 2000 are being assessed and acted upon at various levels by manufacturers, operators, and regulatory authorities. Such activity will lead to enhanced safety, and some positive changes have already been achieved as indicated in Section 4.1 of this report. However, industry-wide progress appears to be unnecessarily slow. For example, although some airline operators have made improvements, the Board remains concerned with the pace of progress in mandating that all aircraft crews have a comprehensive firefighting plan that starts with the assumption that any smoke situation must be considered to be an out-of-control fire until proven otherwise, and that an immediate response based on that assumption is required. Regulatory authorities have not taken substantive measures to ensure that aircraft crews are provided with all necessary firefighting procedures, equipment, and training to prevent, detect, control, and suppress fires in aircraft.

In addition, there are specific aspects that remain problematic. In the recommendation package dealing with in-flight firefighting measures, the TSB expressed concern with the lack of built-in smoke/fire detection and suppression equipment in hidden areas of aircraft. For the most part, smoke/fire detection is reliant on human sensory perception, and fire suppression is dependent on direct human intervention. As shown by this accident, human sensory perception cannot be relied on to consistently detect or locate an in-flight fire. Furthermore, it is unrealistic to rely on human intervention for firefighting in areas that are not readily accessible. The Board believes that the industry, led by regulatory authorities, needs to do more to provide a higher degree of safety by enhancing smoke/fire detection and suppression capabilities.

The TSB expressed concern that there was a lack of awareness in the industry about the potential seriousness of odour and smoke events. The TSB recommended that regulatory authorities take action to ensure that industry standards reflect a philosophy that when odour/smoke from an unknown source appears in an aircraft, the most appropriate course of action is to prepare to land the aircraft expeditiously. Although the tragic events of SR 111 have served to alert the industry to the threat from in-flight fire, the Board believes that the potential for complacency may increase with the passage of time. The Board believes that regulatory authorities need to do more to enhance the regulatory environment (i.e., regulations, advisory material, etc.) to ensure that awareness remains high in the long term and appropriate plans, procedures, and training are in place industry wide.

The TSB has observed that personnel involved with maintaining and operating aircraft remain unaware of the potential existence of flammable materials in their aircraft. In general, the predominant misconception remains as it was before SR 111; that is, that the materials used in aircraft construction are "certified," and therefore are not flammable. As highlighted by this investigation, existing certification criteria do not ensure that materials used in the manufacture or repair of aircraft are not flammable. This lack of awareness continues to lead to circumstances where potential ignition sources, such as electrical anomalies, are viewed as reliability or maintenance issues, and not as potential safety issues and fire threats.

As the threat from an in-flight fire will continue to exist in many in-service aircraft, the Board believes that as a minimum, aircraft crews need to be provided with a comprehensive firefighting plan that is based on the philosophy that the presence of any unusual odour or smoke in an aircraft should be considered to be a potential fire threat until proven otherwise. The Board has yet to see significant industry-wide improvements in certain important areas, and is concerned that regulatory authorities and the aviation industry have not moved decisively to ensure that aircraft crews have adequate means to mitigate the risks posed by in-flight fire, by way of a comprehensive firefighting plan that includes procedures, equipment, and training.

Previous | Next

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

4.3.2  Aircraft System Evaluation: Fire-Hardening Considerations

In its material flammability standards recommendation package issued in August 2001, the TSB identified a deficiency regarding the certification of certain aircraft systems. In its recommendation A01-04, the TSB stated that more validation needed to be done prior to the certification of aircraft systems to ensure that a fire-induced material failure would not exacerbate the consequences of an in-flight fire. The response from the regulatory authorities supported the status quo by declaring that the regulations governing the certification of critical systems, such as hydraulic, oxygen, and flight controls were comprehensive enough to address a system's fire protection and prevention requirements. For other aircraft systems, regulatory authorities have indicated that the combined effect of increasing the material flammability standards, introducing new technologies like the AFCBs, and implementing the recommendations of the Wire Systems Harmonization Working Group will mitigate the risk of initiating or sustaining an in-flight fire.

Testing during the investigation demonstrated that the flight crew oxygen system in the MD-11 could fail in a high heat environment, and exacerbate a fire. The regulatory authorities have not addressed the issue of how the existing regulations allowed for the certification of this oxygen system, which was constructed using dissimilar metals, while providing for the "fire protection and prevention" certification requirement. The design of the oxygen system met the requirements of existing regulations, otherwise, it would not have been approved for use in an aircraft. The same holds true for other materials that failed and exacerbated the SR 111 fire, such as the silicon elastomeric end caps on the air conditioning ducts.

The Board disagrees that the eventual reduction or elimination of flammable materials, and anticipated technological advances, adequately deal with the near-term risk. Therefore, the Board is concerned that regulatory authorities have not taken sufficient action to mitigate the risks identified in the TSB's recommendation A01-04, issued in August 2001, which recommended that as a prerequisite to certification, all aircraft systems in the pressurized portion of an aircraft, including their subsystems, components, and connections, be evaluated to ensure that those systems whose failure could exacerbate a fire-in-progress are designed to mitigate the risk of fire-induced failures.

Previous | Next

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

4.3.3  Aircraft Wiring Issues

  1. 4.3.3.1 - Material Flammability Test Requirements for Aircraft Wiring
  2. 4.3.3.2 - Limitations of FAR 25.1353 Electrical Equipment and Installations
  3. 4.3.3.3 - Potential Limitations of MIL-W-22759/16 Wire

4.3.3.1  Material Flammability Test Requirements for Aircraft Wiring

In one of its recommendations regarding Material Flammability Standards (A01-03), the TSB explained the need to augment the certification test regime used in the approval of aircraft wires. Specifically, the certification criteria need to be expanded to include the determination of wire failure characteristics, using realistic operating conditions and specified performance criteria. The goal of such certification requirements would be to establish standards that would prevent the approval of any wire whose in-service failure could ignite a fire and minimize further collateral wire damage.

Regulatory authorities have advised the TSB that this issue is to be dealt with under the auspices of the FAA's Aging Transport Systems Rulemaking Advisory Committee (ASTRAC). The Board is aware that a Wire Systems Harmonization Working Group has been established to review the certification standards related to aircraft wiring systems. However, in evaluating the assignments of this working group, the Board was unable to identify a specific task that would initiate a review, based on the deficiency described in A01-03.

The Board appreciates that regulatory authorities are dealing with the larger issue of in-flight fires on several fronts, including improved material flammability standards and AFCB technology. While such activities have been beneficial and necessary, the Board is concerned that the deficiency identified in its A01-03 recommendation will not be corrected unless a specific regulatory review of certification requirements is undertaken to ensure the proper evaluation of aircraft electrical wire failure characteristics.

4.3.3.2  Limitations of FAR 25.1353 Electrical Equipment and Installations

During this investigation, the TSB found that there are limitations associated with the interpretation and application of FAR 25.1353(b). In aircraft design, it is not always possible to maintain physical separation between wires, especially in the cockpit area where, typically, space available for installations is confined. The guidance material does not specify what measures or criteria would be acceptable to meet the requirements of FAR 25.1353(b).

The Board has not issued a safety communication on this subject as it is aware that the FAA's ASTRAC (includes the JAA and TC) has been tasked with identifying the requirements for wire separation as they pertain to electrical equipment and installations. Specifically, the ASTRAC is to determine whether a comprehensive wire separation regulation needs to be included in a new wire system rule.

The ASTRAC's final recommendations on this matter have yet to be published; however, the Board is aware that Working Group 6 has declared to the FAA that the creation of separation standards is well beyond the scope of its tasking. Given this situation, it is unlikely that substantive change on the matter of wire separation will result from the current round of ASTRAC assignments. The Board remains concerned about the limitations regarding the interpretation of FAR 25.1353(b) and encourages the regulatory authorities to take follow-up action to research and resolve this matter.

4.3.3.3  Potential Limitations of MIL-W-22759/16 Wire

The primary wire type selected for the IFEN system installation was MIL-W-22759/16. This wire is commonly used by aircraft modifiers and the general aviation industry, although the wire is not used by major aircraft manufacturers, such as Bombardier and Boeing. The wire type is certified and used successfully without any record of inherent problems or adverse service history.

The Board is aware that on 22 March 2002, the United Kingdom Civil Aviation Authority issued Appendix 64 to its Airworthiness Notice 12, entitled Experience from Incidents. Appendix 64 deals specifically with MIL-W-22759/16 Electrical Cable and states, in part:

[P]articular care must be taken when selecting this cable type to ensure that it meets all installation requirements and is fit for its intended application.

The appendix lists several areas that must be addressed prior to the approval of MIL-W-22759/16 wire usage in the United Kingdom.

While the Board has not determined that this wire type is problematic, it remains concerned that, based on the Airworthiness Notice 12, the in-service performance of MIL-W-22759/16 wire may not be fully known.

Previous | Next

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

4.3.4  Flight Crew Reading Light (Map Light)

The Board appreciates that improvements to the FCRL design and to the installations in MD-11s, have been undertaken since its ASA A000008-1 was issued. While it was appropriate that such improvements focused on the MD-11 FCRL and its installation, the Board believes that some of the same design limitations may exist in variants of this FCRL that are installed in other types of aircraft. The Board is concerned that there is not enough being done to apply the lessons learned from the deficiencies of the FCRL installation in the MD-11 to other aircraft installations involving the variants of this FCRL.

Previous | Next

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

4.3.5  Standby Instrumentation

The Board recognizes that TC has committed to reviewing the requirements for standby instrumentation, including related issues such as standby communication and navigation capabilities. TC has indicated that the appropriate approach would be to address these issues in harmony with the FAA and the JAA, and that this objective could be achieved through current and future ARAC activities. The Board remains concerned with the lack of substantive progress in mitigating the risks identified in the TSB ASA A010042-1 (issued 28 September 2001) and encourages TC to work with the FAA and the JAA to expedite the required safety action.

TC indicated that during the certification process, the suitability of the standby instrumentation display(s) and placement are evaluated. TC also indicated that the installation of digital integrated standby instrument systems appears to improve the displayed information. The Board believes that standby instruments should be in a standard grouping layout similar to the primary flight instruments, and that the instruments should be positioned in the normal line of vision of the flight crew. The Board encourages TC to coordinate with the FAA and the JAA to address this issue without further delay.

The Board notes that TC is reviewing training scenarios developed by airline operators. The Board believes that TC should ensure that realistic training scenarios, involving the use of standby instruments, are incorporated in training programs, and that the scenarios include complicating factors, such as loss of additional systems, wearing of oxygen masks and goggles, and smoke in the cockpit.

The Board remains concerned that regulations do not require that standby instruments are capable of remaining powered by an independent power supply that is separate from the aircraft electrical system and battery. The Board believes that with current technology, providing independent standby instrumentation for secondary navigation and communication is feasible. The Board encourages TC to coordinate with the FAA and the JAA to address this issue without further delay.

Previous | Next

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

4.3.6  Contamination Effects

Although the Board determined that contamination was not a factor in the initiation of the fire in SR 111, it remains concerned that the role of contamination in an in-flight fire is not well known. The Board believes that more needs to be done to quantify the risks. The Board is presently investigating the role of contamination in the context of another in-flight fire accident. TSB Investigation Report A02O0123 will address the safety deficiencies associated with contamination of aircraft.

Previous | Next

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

4.3.7  Arc-Fault Circuit Breaker Certification

Significant research and development has been done in recent years to quantify and address the inherent limitations of existing aircraft CB design. This work has resulted in a new type of CB known as the AFCB, capable of reacting to a wider range of arc fault situations. The AFCB will prevent an arc fault from developing into a more serious situation that could damage other nearby wires and will limit the energy available to ignite flammable materials. While the AFCB trip characteristics will provide major improvements over the traditional aircraft CB design, these devices will not be certified to a standard that will require that the AFCB trips prior to the ignition of nearby flammable material. The Board is concerned that unless this aspect of the design specifications is addressed, AFCBs certified for use on aircraft will be capable of remaining energized long enough to ignite nearby flammable material.

Previous | Next

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

4.3.8  Role of the FAA's Aircraft Evaluation Group

Title 49 United States Code section 44702(d) provides the FAA Administrator with the authority to delegate matters related to the examination, testing, and inspection necessary to issue certificates as part of its type certification process. The Administrator has determined that there exist certain aspects that are not to be delegated. One such function is the role of the FAA's Aircraft Evaluation Group (AEG), which is responsible for providing operations and maintenance input to all facets of the type certification process. For STCs, the FAA has determined that no delegate may make determinations regarding operations and maintenance issues; that role is reserved for the AEG.

For STC ST00236LA-D, the impact on the operations and maintenance of the MD-11 was determined by the STC applicant without direct AEG involvement. A survey of similar "non-essential, non-required" IFE system STCs revealed that approximately 10 per cent had been designed, installed, and certified in such a way that the flight crew could not remove electrical power from the IFE system without also interfering with essential aircraft systems. The survey results indicate that the operational review conducted as part of the STC ST00236LA-D approval process, was not unique in not detecting operational shortfalls.

The Board is concerned that a de facto delegation of the AEG's role has evolved with respect to the type certification process, which has resulted in less-than-adequate assessments of the operations and maintenance impact of some STCs, particularly those STCs designated as "non-essential, non-required."

Previous | Next

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

4.3.9  Checklist Modifications

Checklists are designed by aircraft manufacturers and approved by regulatory authorities as part of the original evaluation and approval of aircraft-type design data. As airline operators decide to modify checklists to meet changing operational requirements, there is a need for modified checklists to follow the original design concepts contained in the AFM or other documents associated with the certificate of airworthiness.

In the absence of regulations requiring the approval of checklists that have been modified by airline operators, guidance material should be provided to operations inspectors. The guidance material, as a minimum, should contain methods of checklist design; checklist content; checklist format utilizing human factors principles; immediate action items; and sequencing of checklist items.

The Board is concerned that, given the lack of checklist modification and approval standardization within the aviation industry, airline operators may unknowingly introduce latent unsafe conditions, particularly to emergency checklists.

Previous | Next

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

4.3.10  Accident Investigation Issues

  1. 4.3.10.1 - Flight Recorder Duration and Power Supply
  2. 4.3.10.2 - Underwater Locator Beacon
  3. 4.3.10.3 - Non-volatile Memory

4.3.10.1  Flight Recorder Duration and Power Supply

TSB Recommendations A99-01 through A99-04 were sent to the Minister of Transport in Canada and to the JAA in the Netherlands. The TSB also sent copies of its recommendations to the Swiss Aircraft Accident Investigation Bureau, the United Kingdom Air Accidents Investigation Branch and the French Bureau d'Enquêtes et d'Analyse. Concurrently, the NTSB issued similar recommendations A99-16 through A99-18 to the FAA.

TC has agreed with the recommendations and advises that it is taking measures to amend its regulations by the dates stipulated by the TSB. However, TC also advises that because the FAA is dealing with similar issues raised by the NTSB, it intends to harmonize its actions with those of the FAA. In this regard, the NTSB has expressed its apprehension that, although the FAA has indicated the intention to implement the recommended actions, the dates for final action may not be met.

The Board recognizes that TC has started its consultative process with the Canadian aviation industry, and understands the value of a harmonized approach with US authorities. However, the Board is concerned that TC will also not meet its commitment to implement the required changes in a timely fashion.

4.3.10.2  Underwater Locator Beacon

The flight recorders were recovered from the ocean floor by tracking the acoustic waves emitted from their attached underwater locator beacon (ULB). Given the substantial fragmentation of the aircraft wreckage, and the low visibility water conditions, the ULBs minimized the time required to locate the recorders.

While the recorder's internal crash-protected memory modules were intact, the ULB brackets were damaged. The extent of the bracket damage suggests a high probability that one or both of the ULBs could have readily detached during the impact sequence. The issue of the adequacy of ULB attachments has been a concern of the international recorder community for years.

The Board recognizes that EUROCAE Working Group 50 is developing minimum operational performance specifications for crash-protection of airborne recorders. Currently, these specifications include requirements for the application of impact shock tests to ensure the integrity of a flight recorder's ULB attachment. As EUROCAE recommendations are advisory in nature, the Board is concerned that without adoption and harmonization by regulatory authorities worldwide, ULB attachment specifications may not be universally applied.

4.3.10.3  Non-volatile Memory

Modern aircraft are equipped with electronic systems that contain memory devices designed for data storage. Most commonly, such systems contain a type of volatile memory device whose data is lost when power is removed. Frequently, systems contain a memory device known as non-volatile memory (NVM), which is capable of retaining its stored data even though power has been removed. In the case of SR 111, the engines were controlled with the assistance of full-authority digital electronic control (FADEC) engine control units, which contained NVM devices. In the absence of FDR information, data retrieved from the engine FADEC 2 was helpful in providing some information about the final five-and-a-half minutes of the flight. However, as the FADEC memory was designed for engine maintenance troubleshooting purposes, and the "time stamp" indicating when faults occurred versus when they were written to memory, was of poor resolution for accident investigation purposes. In addition, many other NVM devices from other LRUs were extremely difficult and time-consuming to identify as there were no distinctive markings to facilitate identification.

The Board is concerned that manufacturers and designers of equipment containing memory devices may not consider the potential use of such devices for accident investigation purposes. These aspects are best considered at the design stage, when improvements in data quantity, quality, and ease of device recognition can generally be included for relatively low cost.

This report concludes the Transportation Safety Board's investigation into this occurrence. Consequently, the Board authorized release of this report on 27 March 2003.

Previous

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

  1. ACARS System Description
    1. Messages and Alerts
    2. Radio Frequencies
  2. SATCOM
  3. ARINC and INMARSAT Monitoring Systems
  4. Audit Data Examination
    1. VHF-3 Status during 13-Minute VHF Communications Gap
  5. Audit Data Determination
  6. SATCOM Initialization at 0125:52
  7. ACARS Hardware, Software, and Routing
  8. Swissair Pilot and Maintenance Complaints from February 1995
  9. Wreckage Examination
  10. Loss of VHF ACARS Coverage – Determination
  11. ACARS Data Log

ACARS System Description

The main component of the ACARS system is the CMU. The CMU provides the receive-and-transmit interface through the VHF-3 transceiver and SATCOM for uplinked and downlinked messages. The CMU controls the VHF-3 communication system in data mode and the SATCOM system data link. The primary transmission medium is VHF. The CMU will automatically change to SATCOM when VHF becomes unavailable owing to ground station saturation or insufficient VHF coverage, and will automatically switch back to VHF when such service again becomes available. All messages sent from the aircraft are referred to as downlinks and all messages from ARINC, SITA or INMARSAT to the aircraft are called uplinks. Each downlink may be received by many different VHF RGSs, depending on the area of coverage. Typically, the RGS recording the strongest signal will provide an acknowledgment as an uplink. If there is no communication between the aircraft and RGS for 10 minutes, the CMU will automatically generate a downlink label "Q0" message referred to as a tracker message for flight-following, which is transparent to the crew and was not forwarded to Swissair (as it is not a chargeable message).

The flight crew access ACARS through one of the three MCDUs installed in the pedestal, which provide a variety of menu options from ACARS initialization to obtaining weather reports. Typically MCDU 3 is used for ACARS operations. All three communications radio panels provide the means to select either ACARS or VHF voice capability on the VHF-3 radio.

Messages and Alerts

Uplink messages are printed on the multiport printer located on the aft pedestal or displayed on the selected MCDU. ACARS alert messages are displayed on the EAD and on the selected MCDU scratch pad line. Any alerts generated by the ACARS system are categorized as Level 0 events, displayed as cyan messages on the EAD or SD . Level 0 alerts are usually operational or aircraft system status information. There are three possible ACARS alerts: ACARS message—when data is received, ACARS NO COMM—when ACARS fails to communicate, and VHF 3 VOICE—when VHF-3 is in voice mode. As long as communications are possible over SATCOM, the Level—0 alerts will not be displayed.

Radio Frequencies

The ACARS VHF radio system operates on the following base frequencies, depending on where in the world the aircraft is operating: 131.55 MHz in the USA, 131.475 MHz in Canada through the Air Canada Dataplus network, or 131.725 MHz in Canada and Europe on the SITA network, and 131.450 MHz in Japan. The service providers may also "auto tune" or change the base frequency of the CMU in areas of heavy traffic.

SATCOM

The SATCOM system uses a geostationary satellite network, a global network of GES and AES[1] to supply long-range, two-way data and voice communications. SATCOM, through the SDU, provides voice and data communication links between the aircraft and ground stations, via satellite, in conjunction with the audio management system, passenger telephone system for voice, and ACARS for data. The SDU also uses inputs from the inertial reference system to obtain position and attitude changes for the antenna steering. If navigation and attitude data from Inertial Reference System -1 or -3 are available when the SDU powers up, the SATCOM system will automatically log on to an SDU-selected GES. All satellite communications for this flight were handled through INMARSAT's Atlantic Ocean West satellite and the LRW GES located in Canada.

ARINC and INMARSAT Monitoring Systems

ARINC and INMARSAT audit logs for 2 to 3 September for HB-IWF were requested and provided by SITA via Swissair. According to ARINC and INMARSAT, their monitoring systems were functioning normally during the referenced time period, with no problems reported by other users. Furthermore, INMARSAT records show that the satellite telephone service was not used.

Audit Data Examination

The INMARSAT data started with the log-off of the system at 1837:00 on 2 September 1998 when the aircraft was shut down in New York. The next message logged by INMARSAT from HB-IWF was on 2 September 1998 at 2330:18 as the SATCOM system was powered and it requested to be logged on. The log-on request was a Class 3, for voice and data communications, indicating that the CMU was operational.

After approximately 1 hour and 15 minutes, the aircraft requested the GES to be allocated capacity to send an air-to-ground message. The GES allocated the capacity at 0046:55, and the aircraft sent the message, which was acknowledged by the GES at 0047:06. At 0047:07 the GES sent an uplink acknowledgment for the downlinked media advisory message indicating a loss of VHF communications. Approximately seven minutes later, at 0053:56, INMARSAT logged a second (M1X) message, indicating that VHF communications were confirmed lost for greater than seven minutes. This seven-minute delay is a function of a "T7" timer in the CMU. During this time the CMU will go through the operator's requirement table of frequencies in an attempt to make VHF contact with another service provider. This process is repeated until the CMU finds an active frequency or is shut down. The next message was at 0125:52, at which time the aircraft SATCOM system requested to be logged on as a Class 2 (voice only), indicating that the CMU was not available. This log-on was acknowledged at 0126:01. This was the last message received from the aircraft by INMARSAT.

The ARINC data began with the OFF event (a confirmation that the aircraft had departed from JFK) at 0018:00. This message was sent on the third ARINC frequency, JFKA3, which is typically used as a terminal frequency. This message was logged at 0021:00, as it requires approximately three minutes for the CMU to calculate the estimated time of arrival in Geneva (0656:01). This information was sent to Zurich with the OFF event. This message was acknowledged by ARINC at 0021:07 at which time ARINC requested that the CMU change back to the base frequency of 131.55 MHz, which the CMU acknowledged at 0021:11. At 0021:15, ARINC acknowledged the change to the base frequency. This was the last communication with ARINC for 42 minutes, 59 seconds, until 0104:14, at which time the CMU sent a message indicating a change in operating frequency that is normally associated with a change in service provider, in this case from INMARSAT to ARINC. At this time VHF communications were again established with ARINC.

The flight crew used the ACARS service twice to obtain weather information. The first time was at 0113:13 when the crew requested the actual weather (M28 message) for LLSG (Geneva) plus the nine-hour forecast. The weather forecast was received in five data blocks and was completed at 0114:36. At 0114:37, a second weather request (M27 message) was sent requesting the weather forecasts for LLSG, KBOS, KBGR, and CVQM. This latter identifier is not a recognized airport code and most likely should have been CYQM, for Moncton. The weather forecasts for Geneva, Bangor, and Boston were received, but nothing for the CVQM request. This last request for weather was completed by 0115:18. There were no further recorded crew-initiated communications using ACARS.

At 0125:05, a normal Q0 downlink tracker message was sent by the aircraft for flight-following and was acknowledged by an ARINC RGS at 0125:08. If a communication is not acknowledged, it will be re-transmitted 10 seconds later. As the downlink was not re-transmitted, it may be assumed the acknowledgment was received by the aircraft. This was the last ACARS VHF communication recorded.

Other audit information provided by SITA records a total of nine messages prior to the OFF event being logged. Besides the initialization message by the crew, there was a special load notification to the captain informing him of a dangerous goods shipment consisting of 34 kg of dry ice, cargo information, and the final load sheets. The OUT event was also recorded at 23:50:15. Recording of the OUT event occurs when the aircraft is pushed back from the gate.

VHF-3 Status during 13-Minute VHF Communications Gap

The ACARS audit logs show what appear to be two anomalies. The first was the lack of communication between the aircraft and ARINC from 0021:15 until 0104:14, and the second was that VHF coverage was lost at 0047:06 for 17 minutes, 7 seconds, until 0104:14 in an area of good ARINC ground station coverage.

Switching the VHF-3 radio from data to voice mode would force ACARS to SATCOM without delay. This would result in a media advisory downlink being sent by SATCOM, indicating a loss of VHF. No media advisory message was downlinked between 0021:15 and 0047:06. This indicates that the VHF radio remained in Data mode during this time, as the media message was not sent until 0047:06. The DFDR only reports the radio key events associated with the pilots' microphone keys, and not those associated with the use of VHF-3 in ACARS mode. During this period (from 0021:15 to 0047:06), 21 VHF-1 keying events and 2 VHF-2 keying events were recorded. These keying events occurred between 0022:33 and 0047:06. As there is no indication of a problem with SATCOM communications, the VHF-3 radio was likely not switched to voice mode during that time.

The ACARS CMU monitors the VHF-3 radio transmitter output during data downlink activities. If there is no feedback detected from the VHF-3 radio, the CMU issues a media advisory via SATCOM. No media advisory was downlinked between 0021:15 and 0047:06, when two tracker messages were expected to be downlinked. This indicates that the VHF-3 radio did not fail or lose power.

The ARINC audit data showed that the internal message counter in the CMU was at M63A when communications coverage was lost. When the coverage resumed with ARINC, the CMU message counter was at M66A, which indicates that two messages were generated but not received by ARINC. If these messages had been generated by the crew they would have remained in a message queue until they could be delivered. Also, when ARINC coverage resumed, the systems message counter was updated from S65A to S67A. If the CMU had a power interruption during this time it would, on initialization, reset the message sequence to zero. The message counter was not reset to zero but was incremented, which indicates that the CMU was functioning during this period to generate these messages.

Audit Data Determination

After 10 minutes of no communication, the CMU sends a Q0 labelled tracker message used by the system for flight following. This is an automatic message and is sent without the knowledge of the crew. After the last Q0 labelled downlink test at 0021:15, and assuming no further crew or ARINC-initiated communication, a Q0 tracker message for flight following should have been broadcast 10 minutes later, at approximately 0031:11. For comparison, this would have been similar to the Q0 tracker message recorded at 0125:05 after 10 minutes of no communication. If the CMU does not get an acknowledgment to the Q0 downlink (e.g., owing to VHF congestion) after approximately 70 seconds (40 to 100 seconds) the CMU will switch to the base frequency and try again for approximately another 70 seconds. At the same time, the retry counter is started and, after four tries with no response, the CMU goes to the next frequency in the Operators Table of Frequencies. At this point a service advisory message label is sent, and the T7 timer is started. After seven minutes of no VHF communications, an M1X message is sent via SATCOM indicating a loss of VHF communications. During this seven-minute period, the CMU will go through the other frequencies in the operator's requirement table, attempting to make VHF contact. This process is repeated until the CMU finds an active frequency or is shut down.

A possible scenario for the ACARS communications gap, based on the fact that the system and message counters were updated during this time frame, is postulated as follows:

After the uplink at 0021:15 the tracker timer is started, and just before the tracker timer expires, a new application downlink message (missing M64A) is transmitted. This message is not acknowledged and, after four tries (which takes approximately 1.5 minutes), the CMU switches to the base frequency with the time now at approximately 0032:30. From the data received, the CMU base frequency on the inbound flight could not be determined. If the inbound base frequency was 131.475 MHz (the Air Canada Dataplus network) or 131.725 MHz (SITA Canada) then ARINC may have managed the communications by auto-tune uplinks similar to the auto-tune at 0021:07. If the CMU goes back to a base frequency of 131.475 MHz or 131.725 MHz (both of which are on the fringes of coverage at this time) and establishes contact with downlink message M64A, this might take an additional 2 minutes. Now the time is approximately 0034:30. At this time the tracker timer is started, and a Q0 tracker message is sent, at approximately 0044:30, but it is not acknowledged and the CMU performs "re-tries" over the next 1.5 minutes, to 0046:00. The service advisory logic runs in 1-minute loops, and the time is now 0047:00. The media advisory (label SA) is sent via SATCOM (which would be the missing S66A system message), and at the same time the T7 timer is started. The T7 timer expires and the label 1X message (missing M65A) is sent at 0053:51 for loss of VHF communications for greater than 7 minutes.

The audit data from Dataplus Network and SITA Canada were not available and the above cannot be proved unequivocally. However, the timing does give the scenario credibility. What can be said is that the CMU did not lose power during this time frame. Also, there is no evidence that the crew would have known about the apparent anomaly. When the crew used the ACARS for weather, it functioned normally, again indicating the system was operational at that time.

Once communications were re-established through SATCOM and then back to VHF communication at 0104:14, there were no other interruptions until 0125:52, when the AES made a log-on initiation request through SATCOM, which was acknowledged at 0126:01 as a Class 2 (voice only) mode. This was the last ACARS communication with HB-IWF.

SATCOM Initialization at 0125:52

The installed SDU was manufactured by Honeywell (PN 7516100-20050, Disk PN PS4077-188-927, reference Honeywell SB 7516100-SW5, 1 November 1996).

The INMARSAT logs indicate that at 0125:52 the AES requested to be logged-on and the log-on was acknowledged at 0126:01 as a Class 2 (voice only). The log-on message shows it was an initialization and not a renewal (as occurs if handing off from one satellite to another). The installed software would normally prevent a change in log-on class if either voice or data capability were lost. Therefore, the log-on request was the result of a power interruption. The Class 2 log-on indicates that the CMU was no longer available at this time.

It is not known at what time power to the SATCOM system was interrupted. It could have occurred anywhere between 0053:51 and 0125:52. Typically, the SDU requires one minute from power-on to initiating a log-on if it has been under 24 hours since the last calibration, but it may take two minutes if a more complete calibration is required. There is no way of telling, from the data, the actual time from power-on to the log-on request. This indicates that the SDU lost power some time after the last recorded message at 0053:56, but powered-up between 0123:52 and 0124:52.

For the SATCOM system to be operational in voice-only mode the following components of the system also have to be operational: the SDU, the beam steering unit; the high-power amplifier; radio frequency unit 1; and the IRU-1, IRU-aux, or both. The SDU and radio frequency unit 1 are powered from the 115 V AC Generator Bus 1 (phase A) CB "SATCOM 1A," located in the AU panel at B-28. The beam steering unit and high-power amplifier are powered from CB "SATCOM 1B," located in the AU panel at B-29. IRU-1 is powered from the left emergency 115 V AC bus in the overhead panel at G-22, and IRU-Aux is powered from the 115 V AC Generator Bus 1 (phase A) AU panel at A-22. The IRUs have battery back-up in the event of a power loss.

However, the inertial reference system was active, allowing voice capability at the AES.

ACARS Hardware, Software, and Routing

According to the SR Technics component inventory of "Time Controlled Components," the latest CMU was installed in HB-IWF on 22 December 1997 during an "L check". The CMU was manufactured by Allied Signal PN 965-0758-001, SN 0206. The reason for the installation at this time was an upgrade from Allied Signal, PN 3614291-4523E, to the Mark 11, PN 965-0758-001, as a prerequisite for the Future Air Navigation System. The change was covered by SR Engineering Order 513082 and Douglas SB MD11-23-059. This change also required a re-routing of wires to change the pin programming from 0110 to 1011, the MD-11 standard. According to the engineering order, all of the wire changes were accomplished in the avionics compartment. The following information pertains to the ACARS software installed:

  • DiskPN 963-0100-015
  • Core998-2145-506
  • Application998-2141-502
  • Data BaseM11-SR02-Q03

The CMU is located in the MAR Shelf 4. The CMU is powered from 115 V AC Generator Bus 3 (phase A) through CB B1-33 mounted in the avionics CB panel on row D, location 27. From the CB D-27 terminal, wire B101-21-24 is tie-wrapped onto the other wires that are attached to the CBs on row D. These wires follow the grey-sleeved bus feed B117-4-8 and are routed to the lower aft corner of the avionics CB panel where they join all the other wires from the CB panel and become wire run AMA. The majority of these wires are then routed outboard and up toward one of the nine plugs in the avionics CB disconnect panel mounted at Station 396 on the aft cockpit wall. B101-21-24 connects to pin X of P1-323/R5-323 connector on the avionics CB disconnect panel, then via B203-110-24 (wire routing AAC down right side into avionics compartment) to pin Y of P1-134/R5-134 connector located in MAR Shelf 4. Then connects via B3044-20RD to pin 35JX of terminal strip S3-24 on MAR Shelf 4 and via 455-20RD to receptacle R5-1020C on the CMU.

Swissair Pilot and Maintenance Complaints from February 1995

In 1995, there were 23 complaints logged on the ACARS system. The majority of complaints were of OUT and IN events not being recorded, along with messages and weather reports not being received. There was one reference to a CB reset on 20 August 1995, but this did not resolve the problem of no OUT event times. The CMU was replaced four times in 1995. In 1996 there was only one reference to ACARS, and that was for a briefing card. In 1997, there were three records, one of which was for the ACARS printer missing some digits and an initialization failure. These last three complaints were cleared on the ground, with no fault found. In 1998, there was only one complaint, on 27 January 1998, for "mission status data lost during cruise," and the check action was "checked OK." The review showed no CB trips being recorded. From the time the new part number CMU was installed in December 1997, there was only one complaint noted.

Wreckage Examination

The CMU was not found in the wreckage. Most of the avionics CB panel was re-built, along with those sections of identified bus bar from that panel. The remains of the row D bus bar, from D-22 to D-34, was recovered. The insulation material that covers the bus bar was mechanically damaged and had a "heat-shrivelled" appearance. None of the CBs were recovered from the panel, but a few of the white collar trip indicators were found trapped in the panel. Also recovered was a section of the AU panel containing the holes for CBs B-28 to B-30, C-27 to C-31, D-25 to D-30 and E- 24 to E-31. The white collars remained in D-26 and D-29. The white collar on D-26 was clean and did not exhibit any discolouration from soot, which suggests that it had not tripped prior to impact. The collar of CB D-29 was slightly discoloured, with a soot-like appearance, but this discolouration was not as uniform as examples of white collars, from other locations, that were covered in soot. This latter fact may indicate that the CB D-29 tripped near the end of the flight.

Approximately 3 inches of the wire from CB D-27, B101-21-24 was still attached to connector P1-323. No other wires were identified from this system. The aromatic polyimide wire insulation on the wire was intact and exhibited minor sooting but no discolouration of the modified aromatic polyimide resin topcoat. The connector P1-323 was generally intact and the red grommet material, although uniformly blackened from soot, was still resilient.

Recovered from the wreckage were four 24 AWG aromatic polyimide-insulated wires that exhibited melted copper damage as a result of an arcing event. Only one of these wires was positively identified as to its function: Fire 2 Engine Detection. It was not possible to determine whether the remaining arced wires were part of the ACARS CMU circuitry.

Loss of VHF ACARS Coverage – Determination

Analysis of the available logs shows that the VHF-3 radio had not been switched to the voice mode nor had a power failure occurred between 0021:15 and 0047:06, as both of these scenarios would have resulted in a media advisory being immediately downlinked via SATCOM. The media advisory sent at 0047:06, indicating a loss of VHF communications at this time, could have been the result of the crew switching VHF-3 from data to voice mode. This latter shows that the SATCOM system was functional at this time. The ACARS CMU was shown to have been functional during this time; its internal sequence generator was updated and not reset to zero, as would have been the case had it had a power interruption.

The ACARS CMU may have been operating temporarily on a VHF frequency other than ARINC (either Dataplus or SITA); it was not until 0047:06 that this coverage was lost, and it took until 0104:14 until coverage resumed with ARINC. The crew used the ACARS VHF communications twice after this, without any problems, to obtain weather reports.

The ACARS information was analyzed to determine whether the apparent anomalies noted could have played any role in the initiating of the on-board fire. As the crew never mentioned any problems with the system, and both the ACARS VHF and SATCOM modes functioned normally after the reported smell and subsequent confirmation of visible smoke, it was determined that the ACARS and SATCOM systems did not contribute to the initiation of the fire.

ACARS Data Log

Table: ACARS Data Log

UTC HHMM:SS SOURCE MESSAGE/COMMENTS
2 Sept. 1998
1837:00
INMARSAT
LRW
SATCOM LOG-OFF request
LRW declares the AES is in log-off status. Aircraft HB-IWF is switched off in New York. No reported problems with ACARS on the inbound flight.
2318:00 ARINC RGS (JFK) M10 Downlink (D)
Flight Initialization by crew input, origin, destination, date, time aircraft identification.
2318:56 ARINC RGS (JFK) M3L Uplink (U)
Incoming flight information.
2330:18 LRW R1/2(Q,Ref)=d,0 DL8 LOG-ON REQ:Yes_LOV INI PRIExSAT IO:NULL
Log-on request is accepted by LRW as a Class 3 (voice and data). Class 3 log-on indicates that ACARS management unit was operational.
2330:28 LRW SATCOM log-on process concluded
2343:27 ARINC RGS (JFK) M33
Incoming Notice to Captain Special Load Notification. Dangerous goods, 34 kg dry ice, and other special load, 57.8 kg valuable cargo.
M30
Incoming Loadsheet
  • dry operating weight: 137 830 kg
  • zero fuel weight: 176 847 kg, maximum 185 970 kg
  • take-off fuel: 64 300 kg
  • take-off weight: 241 147 kg, maximum 285 990 kg
  • trip fuel: 49 600 kg
  • landing weight: 191 547 kg, maximum 199 580 kg
  • underload: 8 033 kg
PAX/10/42/161 TTL 215
2359:00 ARINC RGS (JFK) M2A
OUT event (Off Block aircraft pushed back from gate).
3 Sept. 1998
021:04
ARINC RGS (JFKA3) D SR0111 2B M63A<N>69 0-53!2HB-IWF52B"M63ASR01110018,KJ
OFF event received at time shown but HB-IWF actually took off at 0018:00. Three-minute built-in delay in reporting to allow FMS to calculate estimated time of arrival. The number "3" at the end of the RGS station JFKA3 indicates that communication from HB-IWF is on the ARINC third frequency.
0021:07 ARINC RGS (JFKA3) U - JFKA3 SR00111:;---- 0 -1 D S 21 !2.HB-IWF0:;D"131550#
Auto-tune message to switch frequency to 131.55.
0021:09 ARINC RGS (LGAB3) D SR0111__S64A D 64 1 - 24 !2.HB-IWFD__"S64ASR0111#
Acknowledgment of uplink.
0021:11 ARINC RGS (JFKB) D SR0111 Q0 S65A<N> 70 2 - 24 !2.HB-IWF5Q0"S65ASRO111#.
Link test to validate that the frequency change is good.
0021:15 ARINC RGS (JFKB) U SR0111 __ ---- 2 -1 E S 14 !2HB-IWF2__ E#
Acknowledgment to downlink test S65A.
No ARINC VHF Communications recorded from aircraft for 25 minutes and 40 seconds.
0033:12 (For reference) Last communications from SR 111 prior to the 13-minute gap.
0042:32 (For reference) Start of keying events on VHF 1 and VHF 2 for 3 minutes and 57 seconds.
0047:06 LRW D - SA label received
VHF 3 communications were lost.
0047:07 LRW U - Acknowledgment sent to HB-IWF for SA downlink.
0047:18 (For reference) SR 111 transmission is recorded by ATC Boston ARTCC on 134.95 MHz through VHF 1 and given new frequency of 133.45 MHz.
0053:56 LRW D - M1X label received
Loss of VHF 3 communications confirmed for more than seven minutes.
0053:56 LRW U - Acknowledgment sent to HB-IWF for M1X downlink.
0104:14 ARINC RGS (BOSB) D - SR0111 1A M66A<N> 50 3 - 46 !2HB-IWF51A"M66ASRO111
03SEP98
The 1A label indicates a change in operating frequency. This would most often be associated with a change in service provider. This message would be delivered to Swissair's ground computer so they can track a change in service provider and recognize which provider to use in delivering an uplink message. The message at 0021:04 had the message M63A; when coverage returned the message sequence was at M66A, indicating some messages were created by the CMU from the time of last communications.
0104:19 ARINC RGS (BGR) U - SR0111 __ ---- 3 -1 F S 14 !2HB.IWF3__ F#
An uplink acknowledgment to the 1A downlink.
0104:53 ARINC RGS (BGR) D - SR0111 SA S67A<N> 56 4 - 36 !2.HB-IWF5SA"S67ASR0111
0EV0104.
A media advisory message indicating communications were re-established with ARINC on VHF 3 at 0104:14.
0104:56 ARINC RGS (BGR) U - SR0111 __ ---- 4 -1 G S 14 !2.HB-IWF4__G#
An uplink acknowledgment to the downlink SA report.
0110:38 (For reference) First reported smell by crew (CVR data).
0113:13 ARINC RGS (YHZB) D - SR0111 28 M67A<N> 56 5 - 32 !2.HB-IWF528"M67ASR0111
,,,,LSG
A downlink request (label 28) for weather at SF ACT+9H at LSG. This message was initiated by the crew.
0113:16 ARINC RGS (YHZB) U - SR0111 __ ---- 5 -1 H S 14 !2.HB-IWF5__ H#
An uplink acknowledgment to the weather request.
0113:42 ARINC RGS (YHZB) U - SR0111 28 ----<N> -1 I S 235 !2.HB-IWF528I"
Block 1 of the SF ACT+9 weather report. The largest uplink block in ACARS is 220 characters of text. For larger messages the text is divided into individual blocks for transmission.
0113:49 ARINC RGS (YHZB) D - SR0111__ S68 I 56 6 - 24 !2.HB-IWFI__"S68ASR0111#
Downlink acknowledgment of the Block 1 weather uplink.
0113:52 ARINC RGS (YHZB) U - SR0111 28 ----<N> -1 J F 235 !2.HB-IWF528J"005KT8000 RA SC
Block 2 of the SF weather report uplink.
0114:02 ARINC RGS (YHZB) U - SR0111 28 ----<N> -1 J S 235 !2.HB-IWF528J"005KT8000 RA SC
Retransmission of Block 2 weather report uplink. The aircraft did not respond to the first attempt. Second and subsequent uplink attempts are made at 10 second intervals. This second attempt was successful.
0114:11 ARINC RGS (YHZB) U - SR0111 28 ---- <N> -1 K S 235 !2.HB-IWF528K"40 OVC100 PROB30
Block 3 of the SF weather uplink.
0114:18 ARINC RGS (YHZB) D - SR0111__ S70A K 57 8 - 24 !2.HB-IWFK__"S70ASR0111#
Downlink acknowledgment for the Block 3 SF weather uplink.
0114:21 ARINC RGS (YHZB) U - SR0111 28 ---->N> -1 L S 235 !2.HB-IWF528L"0 SCT050 SCT090
Uplink of Block 4 of the SF weather uplink.
0114:27 ARINC RGS (BGR) D - SR011 __ S71A L 53 9 - 24 !2.HB-IWFL__"S71ASR0111#
Downlink acknowledgment for the Block 4 SF weather uplink.
0114:31 ARINC RGS (YHZB) U - SR0111 28 ----<N> -1 M S 235 !2.HB-IWF528M"BECMG
Uplink of Block 5 weather message.
0114:36 ARINC RGS (BGR) D - SR0111 __S72A M 54 0 - 24 !2.HB-IWFM__"S72ASR0111#
Last downlink acknowledgment for the SF weather Block 5. Last block of the 5-block message.
0114:37 ARINC RGS (BGR) D - SR0111 27 M68A <N> 40 1 - 44 !2.HB-IWF527"M68A
SR0111LLSG,KB
A downlink request (label 27) for SA weather at LSG. This message was initiated by the crew.
0114:41 ARINC RGS (YHZB) U - SR0111 28 ---- 1 -1 N F 102 !2.HB-IWF128N"3KT 8000 FEW040
No response from aircraft; therefore, second attempt made 10 seconds later.
0114:51 ARINC RGS (YHZB) U - SR0111 28 ---- <N> -1 N F 102 !2.HB-IWF528N"3KT 8000 FEW040
The system block uplink success rate is between 70% and 95%; a failed uplink attempt is not abnormal. The second attempt made 10 seconds later was successful.
0114:56 ARINC RGS (YHZB) D - SR0111 27 M68A N 58 1 - 44 !2.HB-IWFN27"M68A
SR0111LLSG,KB
Another copy of the label 27 SA weather request. Note the message of M68A (0114:37). This message includes an acknowledgment for Block 1 of the SA report uplink above.
0115:00 ARINC RGS (YHZB) U - SR0111 __---- 1 -1 O S 14 !2.HB-IWF1__ O#
The uplink acknowledgment to the downlink weather request M68A.
0115:03 ARINC RGS (YHZB) U - SR0111 27 ----<N> - 1 P S 235 !2.HB-IWF527P"
Block 2 of the SA weather report uplink.
0115:08 ARINC RGS (BGR) D - SR0111__ S74A P 50 2 - 24 !2.HB-IWFP__"S74ASR0111#
Downlink acknowledgment for the Block 2 SA weather report uplink.
0115:13 ARINC RGS (YHZB) U - SR0111 27 ---- <N> - 1 Q S 136 !2.HB-IWF527Q"A FEW015 BKNO40
Block 3 of the SA weather report uplink.
0115:18 ARINC RGS (BGR) D - SR0111 __ S75A Q 51 3 - 24 !2.HB-IWFQ__"S75ASR0111#
Downlink acknowledgment for the Block 3 SA weather report uplink.
0125:05 ARINC RGS (YHZB) D - SR0111 Q0 S76A <N> 60 4 - 24 !2.HB-IWF5Q0"S76A
SR0111#
This is a Q0 labelled tracker message used by the system for flight following. It is not a message that is delivered to Swissair because it contains no applications test. It is an automatic message and is transparent to the crew.
0125:08 ARINC RGS (YHZB) U - SR0111 __ ---- 4 -1 I 14 !2.HB-IWF4__R#
An uplink acknowledgment for the downlink tracker message. Since the downlink was not retransmitted it can be assumed that the acknowledgment was successfully received by the aircraft.
0125:52 LRW AES makes a log-on request.
0126:01 LRW Log-on acknowledgment; successfully completed as a class 2 (voice only)
First traffic between the AES and the GES (LRW) since 0053:56. The AES may have gone into a re-log-on process because the CMU stopped responding.
0230:12 LRW Log-On Interrogation
Approximately one hour later the normal log-on interrogation sequence from the GES takes place. When the AES does not respond after five interrogations, the GES declares the AES as being logged off.

[1]    AES stands for "airborne earth station" within the ACARS discussion.

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

  1. ADG System Description
  2. ADG Examination
    1. Air Turbine Unit Examination
    2. Brushless Generator Examination
    3. Mounting Strut Assembly Examination
  3. ADG Determination

ADG System Description

The ADG consists of a ram air-powered, automatic speed-controlled, 28-inch diameter, two-bladed air turbine unit that drives a 25 kVA, three-phase, 115 V AC, 400 Hz brushless generator. To maintain a constant voltage setting, the generator and turbine turn at speeds of 12 000 rpm and 4 839 rpm, respectively.

The ADG is mounted via a strut assembly in Air Conditioning Compartment 3 located on the lower right-hand side of the fuselage to the right of the nose gear doors at station 570.

(See photograph of "Air-driven generator in aircraft.")

In the stowed position, the blades of the turbine are aligned in the fore and aft direction. The ADG is extended by a red lever and a mechanical linkage arrangement located in the cockpit on the lower right-hand side of the centre console. The lever is safety wired in the stowed position. It is designed to be pulled aft and lifted for deployment. Once the lever is pulled, the ADG moves out of the fuselage into the airstream, with the help of two springs. The ADG is deployed with the help of pressure created by airflow against the propeller blades and the weight of the ADG as it falls. Once deployed, the ADG cannot be re-stowed in flight. To prevent damage to the ADG or to the ADG stowage compartment during deployment, the ADG is equipped with an anti-rotation lock. The anti-rotation lock prevents the turbine from rotating until the ADG is approximately 90% extended.

ADG Examination

The ADG had torn free from the aircraft at the time of impact and was recovered in three major sections:

(See photograph of "Recovered pieces.")

  1. Air turbine unit
  2. Brushless generator
  3. Mounting strut assembly

Air Turbine Unit Examination

The air turbine unit was recovered missing the spinner and one of its two propeller blades. According to the dataplate, the unit was manufactured by Kaiser Marquarot (PN 226260-501, SN 0037). The air turbine unit had separated from the generator flange and had sheared five of its six mounting bolts. The threads of the remaining bolt had been stripped out of the hub. The generator flange was fixed in place and was not free to rotate owing to impact damage to the generator housing. The air turbine unit was mated with the generator flange; the orientation of the turbine blade and blade stub placed the blades in the fore and aft or stowed position. No rotational markings were noted on the turbine hub. The propeller blade exhibited no leading edge damage or chordwise marks or scratches that would indicate rotation of the blade.

(See photograph of "Air turbine unit - propeller blade - leading edge.")

The trailing edge of the blade was damaged as a result of having been driven back into the generator and strut assembly. The back of the blade exhibited longitudinal gouges that matched the spacing of the studs at the generator/strut attachment flange.

(See photograph of "Air turbine unit - propeller blade - trailing edge.")

Examination of the fractured blade stub indicated that the blade broke off in bending overload.

(See photograph of "Air turbine unit - propeller blade stub.")

There was no evidence of torsional forces acting on the blade at the time of separation.

The corner edge of the detent of the ADG anti-rotation lock assembly was flattened, indicating engagement of the lock plate at the time of impact.

(See photograph of "Anti-rotation lock plate - detent edge flattened.")

The turbine hub exhibited marks that matched the damage to the anti-rotation lock casting ears located on the generator. The alignment of the marks in parallel to the casting ears indicated that the marks were made as a result of the turbine being driven out of a locked and static position.

Brushless Generator Examination

The brushless generator was recovered with a portion of the mounting strut flange attached. The generator was identified by Swissair tag IDN 474746. The generator case was punctured, and the armature was pinched in place and was not free to rotate.

The electrical generator supply cables were found captured within the mounting strut. The cables were sheared at both ends of the strut. The cable ends were examined for signs of electrical arcing that would suggest operation of the ADG. No evidence of electrical arcing was found.

Mounting Strut Assembly Examination

The damage to the leading edge of the strut assembly matched the damage pattern noted on the trailing edge of the aft propeller blade. This pattern was consistent with the blade being pushed rearward while in the stowed position. The anti-rotation lock linkage mechanism was contained within the strut bosses and was bent and captured in the stowed position.

(See photograph of "Anti-rotation lock mechanism.")

ADG Determination

The absence of rotational damage to the turbine hub and propeller blade, combined with the captured and stowed position of the anti-rotational lock assembly and the relationship of the impact damage pattern, indicates that the ADG was in the stowed position at the time of impact.

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

  1. Communications System Description
    1. Very High-Frequency Communications System
    2. High-Frequency Communications System
    3. Communication Radio Panels
    4. Audio Control Panels
      1. Flight Interphone System
    5. Service Interphone/Call System
    6. Passenger Address System
    7. Selective Calling System
    8. Cockpit Voice Recorder System
    9. Aircraft Communications Addressing and Reporting System
    10. Satellite Communications System

Communications System Description

Very High-Frequency Communications System

The VHF communications system consists of three separate, identical systems. The systems provide short-range, line-of-sight communications between the aircraft and the ground or other aircraft. In general, the number one radio is used for ATC communications; the number two radio is used for ATIS, company communications, Oceanic clearances, and so on. The number three radio is normally used for ACARS.

High-Frequency Communications System

The HF communications system consists of two separate, identical systems. The systems provide long-range communications between the aircraft and the ground or other aircraft.

Communication Radio Panels

Three CRPs are installed in the aft pedestal to enable the flight crew to tune the communications systems. Selecting one of the five radio switches causes the selected switch to illuminate and the associated active and standby frequencies to be displayed. New frequencies are placed in the standby memory by turning the frequency selector knob and are transferred to the active mode by use of the transfer button.

(See illustration of "Communication radio panel.")

Audio Control Panels

There are three ACPs: two on the aft pedestal and one at the observer station. The ACPs provide transmit and volume control for the communication radios, interphones, and PA system, as well as volume control for the navigation receivers. An INT/RADIO switch provides the same function as the PTT switch on the control wheel. When this switch is pushed and held to INT, flight interphone transmission is possible. When the switch is held in the RADIO position, radio transmission is possible.

(See illustration of "Audio control panel.")

Flight Interphone System

The flight interphone is used by members of the flight crew to communicate between each other in the cockpit and is controlled by the three ACPs. When the full-face oxygen masks stowage box doors are opened, the boom microphone automatically switches to the mask microphone. Flight interphone transmitting can be achieved with the PTT switch on either control wheel, the INT switch on the ACP, or any radio PTT switch if the MIC INT button is pushed on the ACP. When transmitting on interphone, the standard Swissair practice is to use the INT switch on the ACP.

Service Interphone/Call System

The service interphone/call system enables communication between the cockpit and the cabin crew stations and the maintenance service areas. The call system is used to alert the flight crew or cabin crew that another station is calling.

Passenger Address System

The PA system enables the flight crew and cabin crew to address passengers throughout the cabin and in the lavatories.

Selective Calling System

SELCAL operates in conjunction with the VHF and HF systems to provide visual and aural indications that the aircraft is being called by a ground station.

Cockpit Voice Recorder System

The voice recorder system automatically records the last 30 minutes of all flight and service interphone and radio communications initiated and received by the flight crew. A cockpit area microphone, located in the recorder panel in the overhead panel, sends ambient cockpit sounds to the CVR to be recorded. Boom microphones also send ambient and voice sounds to the CVR to be recorded as "hot microphones," independent of the position of their respective PTT switches. Additionally, when the captain’s or first officer’s full-face oxygen mask is removed from its respective oxygen mask stowage box and the box door is opened, the respective boom microphone is switched off and the microphone in the mask is recorded as a hot microphone, regardless of whether the PTT switches are used.

Aircraft Communications Addressing and Reporting System

ACARS provides two-way data communications through VHF 3 or SATCOM through the ACARS management unit.

Satellite Communications System

SATCOM uses satellite and ground stations to relay transmissions to and from the aircraft.

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

  1. Electrical System Description
    1. AC Power and Distribution
    2. DC Generation
    3. Control and Protection
  2. Emergency Power
  3. CABIN BUS Switch
    1. Description
    2. Examination
    3. Determination
  4. Known Electrical Power Distribution at the Time of Impact

Electrical System Description

Three 120 kVA, three-phase 115 V AC, 400 Hz engine-driven IDGs are the primary source of power for the in-flight operation of the AC and DC electrical system. Each IDG is attached to an engine accessory gearbox by a quick attach/detach adapter. Each IDG incorporates a hydro-mechanical constant speed drive and a generator. The constant speed drive portion is designed to provide a constant output speed, irrelevant of the input speed from the engine accessory gearbox. This constant output speed produces a constant 400 Hz output.

The electrical system may also be powered by an APU or an external source through two external power receptacles (main and galley). The APU is installed in the tail section and provides electrical power for ground operation and also serves as a supplemental electrical power source in flight, when required.

(See illustration of "Electrical system.")

AC Power and Distribution

Each IDG is connected through a generator relay to its own generator bus. Each generator bus is then connected to its associated AC buses. Parallel operation of the generator buses occurs through the AC tie bus. This permits an IDG or IDGs to supply power for all the electrical loads.

Generator Bus 1 normally powers the left emergency AC bus; Generator Bus 2 normally powers the AC ground service bus through the AC ground service tie relay; and Generator Bus 3 normally powers the right emergency bus. The ground service bus permits the supply of APU generator power or external power for use in ground operations. The AC generator buses and the AC ground service bus supply most of the high-current and centrally located loads or both, such as the hydraulic pumps, most of the fuel pumps, and the galley power. Power for the lower current, non-centrally located loads, and essential loads is supplied through the three AC buses, cabin AC buses, ground service bus, and the two emergency AC buses. Separate instrument buses supply their respective component loads.

DC Generation

The AC generator buses distribute power to the four, 75 A unregulated TRs. The TRs change three-phase 115 V AC, 400 Hz power to 28 V DC power. The total DC power system load is less than the power output capacity of two TRs. The four TRs usually operate in parallel; however, it is possible to isolate a TR such that it only supplies power to its bus. When isolated, TR1 is powered by Generator Bus 1, TR2A is powered by Generator Bus 2, TR2B is powered by the generator ground service bus, and TR3 is powered by the right emergency AC bus.

Control and Protection

Electrical supply and control normally occurs automatically through the EPCU, the three GCUs, and the APU GCU. If the automatic system fails, the flight crew can control the electrical system from the forward overhead panel. The EPCU transmits system and status and failure data to the EAD and to the system display. The applicable system alerts are shown on the EAD and the system display.

Each of the four GCUs control their respective generator relay, bus tie relays, IDG disconnect (crew commanded), and DC ties 1 and 3, and regulate the IDG and APU generator voltage, IDG frequency, and current limit and load control. Each GCU protects its respective generator from electrical faults. The GCUs automatically operate IDG resets resulting from generator protective trips and AC generator bus fault resets. The GCUs also maintain IDG oil temperature and pressure indications for IDG fault indicating.

The EPCU protects

  • load shedding;
  • main external power; and
  • galley external power.

Emergency Power

The left emergency power system consists of one main 28 V DC battery, a battery charger, a static inverter and a manually deployed ADG. The main battery consists of two 14 V DC nickel-cadmium batteries connected in series for a 28 V DC system. The battery charger converts AC input into a controlled DC output to keep the battery fully charged. The static inverter is a 2 400 VA inverter installed in the avionics compartment. It changes battery DC power into 115 V AC, 400 Hz, single-phase power. The ADG is an air-cooled, 25 kVA, three-phase, 115 V AC, 400 Hz turbine generator that consists of an air turbine unit, brushless generator, and voltage regulator.

The EMER PWR selector is located in the forward overhead panel. The switch has three positions: OFF, ARM, and ON. The ON or OFF position control the left emergency control relay. The function of each position is as follows:

  • OFF: Battery is not allowed to supply power to the static inverter for the left emergency AC bus and the left emergency DC bus.
  • ARM: EPCU is allowed to automatically transfer battery power to the static inverter and DC bus when system conditions are correct.
  • ON: Battery supplies power to the left emergency AC bus via the static inverter and to the emergency DC bus.

When the EMER PWR selector is in the OFF position and the aircraft electrical power is on, the Emergency Power OFF light in the forward overhead panel will illuminate amber.

With the EMER PWR selector in the ARM position and the BATTERY switch in the ON position, a loss of power to the left emergency AC or DC buses will cause the EPCU to automatically transfer main battery power to the left emergency DC bus and to the static inverter, which powers the left emergency AC bus. This loss of power assumes the SMOKE ELEC/AIR selector is not in the 1/2 OFF position. The battery alone will supply approximately 15 minutes of emergency power to the captain's flight essential equipment during an all-engines or all-generators failed situation. Rotating the EMER PWR selector to the ON position will also result in the same power transfers to the battery.

When deployed, the ADG operates in one of two modes: Hydraulic or Electrical. In Hydraulic mode, the ADG ELECTRIC switch is in the OFF position and the ADG supplies electrical power to the electrically driven auxiliary Hydraulic Pump 1. When the EMER PWR selector is selected ON and the ADG is in the Hydraulic mode, the ADG will supply electrical power to the auxiliary Hydraulic Pump 1 and to the left emergency AC bus.

In Electrical mode, the ADG ELECTRIC switch is in the ON position. When the EMER PWR selector is selected ON, the ADG supplies electrical power to the left and right emergency AC buses, which power the captain's and the first officer's flight-essential equipment. The right emergency AC bus also supplies power to TR3, which supplies power to the battery bus and the left and right emergency DC buses. The right emergency AC bus supplies power to the battery charger, which in parallel with the battery, powers the battery direct bus. With the BATTERY switch in the ON position, the batteries are charged by the ADG.

CABIN BUS Switch

Description

The CABIN BUS is a guarded switch that is located in the forward overhead panel directly below the SMOKE ELEC/AIR selector. The CABIN BUS switch controls the electrical power to the cabin and ground service buses, and is active with the electrical system in either the auto or manual mode of operation.

When pushed, a level 1 alert message, "ELEC," is generated on the EAD and the alert "CABIN BUS SW OFF" is annunciated on the system display. The CABIN BUS switch illuminates amber "OFF" indicating that the following buses are de-powered: cabin AC buses 1 and 3 (galley buses, cabin individual air and recirculation fans, and cabin lights), forward and mid-cabin AC ground service bus, and the overwing and aft cabin AC ground service bus.

Activation of the CABIN BUS switch supplies power from the 28 V DC battery bus through the emergency panel miscellaneous lights and cabin bus control CB, B1-879, located at position C-28 on the overhead CB panel to the cabin bus control relays R2-5774 and R2-5775 located in the equipment rack forward relay panel in the avionics compartment. When energized, relays R2-5774 and R2-5775 open eight RCCBs to remove the cabin bus and ground service power. Removing power from these two relays will re-energize the cabin buses if primary power is available.

Examination

The emergency panel miscellaneous lights and cabin bus control CB was located in an area of high heat (as high as 343°C). The CB was not identified.

CB B1-112 at position C-30 (RCCB BACKUP POWER) was identified. The CB exhibited soot accumulation on the white indicator ring. The wire run from the emergency panel miscellaneous lights and cabin bus control CB to the cabin bus control relays was also located in an area of high heat.

Determination

The emergency panel miscellaneous lights and cabin bus control CB was not recovered; however, because of the high heat in this area, a thermal tripping of this CB is possible. If this CB were to trip, the power to the cabin buses would be restored, and in part, power to the recirculation and individual air fans and cabin lights would be restored.

The soot accumulation on CB B1-112 at position C-30 is consistent with the CB tripping prior to impact (it is unknown whether this CB had tripped as a result of an electrical arcing event or as a result of the surrounding temperature (a trip by ambient heat).

The effects of heat or fire on the wire run from the emergency panel miscellaneous lights and cabin bus control CB to the cabin bus control relays could cause a tripping of the CB or an opening of the circuit, which would enable the cabin buses to become re-energized.

Known Electrical Power Distribution at the Time of Impact

Table: Known Electrical Power Distribution at the Time of Impact

Electrical Component Operating Aircraft Bus CB CB Location
Tail Tank Left Fuel Transfer Pump 115 V AC Generator Bus 1 B1-394
3-ø
B21 Upper Main CB Panel
Upper Aux Tank Right Fuel Transfer Pump 115 V AC Generator Bus 1 B1-1250
3-ø
B23 Upper Main CB Panel
Tank 1 Forward Fuel Boost Pump 115 V AC Generator Bus 1 B1-614
3-ø
B24 Upper Main CB Panel
Tank 3 Fuel Transfer Pump 115 V AC Generator Bus 1 B1-618
3-ø
B26 Upper Main CB Panel
Tail Tank Left Fuel Transfer Pump Control 115 V AC Bus 1 B1-542 E22 Upper Main CB Panel
Upper Aux Tank Right Fuel Transfer Pump Control 115 V AC Bus 1 B1-1206 E23 Upper Main CB Panel
Tank 1 Forward Fuel Boost Pump Control 115 V AC Bus 1 B1-615 E24 Upper Main CB Panel
Tank 3 Fuel Transfer Pump Control 115 V AC Bus 1 B1-619 E26 Upper Main CB Panel
CAC Cooling Fan 1 115 V AC Bus 1 B1-270 3-ø L18 Upper Main CB Panel
Cabin Air Recirculation Fans 115 V AC Bus 1 and 115 V AC Bus 3 or both    
Avionics Compartment Cooling Fan 115 V AC Bus 2 B1-357
3-ø
M11 Upper Main CB Panel
Tank 1 Aft Fuel Boost Pump 115 V AC Generator Bus 3 B1-612 3-ø D24 Upper Main CB Panel
Tank 2 Fuel Transfer Pump 115 V AC Generator Bus 3 B1-756 3-ø D25 Upper Main CB Panel
Tank 1 Aft Fuel Boost Pump Control 115 V AC Bus 3 B1-613 G24 Upper Main CB Panel
Tank 2 Fuel Transfer Pump Control 115 V AC Bus 3 B1-757 G25 Upper Main CB Panel
Avionics Overheat Light 28 V DC Bus 3 B1-320 S08 Upper Main CB Panel
Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

  1. Ventilation, Cooling, and Recirculation Fans
    1. Examination
    2. Determination
  2. Aft Chiller Ventilation Fan
    1. Description
    2. Examination
    3. Determination
  3. Avionics Compartment Cooling Fan
    1. Description
    2. Examination
    3. Determination
  4. CAC Cooling Fans 1 and 2
    1. Description
      1. CAC Cooling Fan 1
      2. CAC Cooling Fan 2
    2. Examination
      1. CAC Cooling Fan 1
      2. CAC Cooling Fan 2
    3. Determination
      1. CAC Cooling Fan 1
      2. CAC Cooling Fan 2
  5. Avionics Compartment Exhaust Fan
    1. Description
    2. Examination
    3. Determination
  6. Avionics Venturi Valve
    1. Description
    2. Examination
    3. Determination
  7. Aft Tunnel Venturi Valve
    1. Description
    2. Examination
    3. Determination
  8. Avionics Rack Cooling Fans
    1. Description
    2. Examination
    3. Determination
  9. Forward Cargo Compartment Ventilation Fan
    1. Description
    2. Examination
    3. Determination
  10. Aft Cargo Compartment Ventilation Fan
    1. Description
    2. Examination
    3. Determination
  11. Cabin Individual Air Fan
    1. Description
    2. Examination
    3. Determination
  12. Cabin Air Recirculation Fans
    1. Description
    2. Examination and Determination
      1. Recovered Fan Exhibit 1-2467
      2. Recovered Fan Exhibit 1-9196
      3. Recovered Fan Exhibit 1-11297
      4. Recovered Fan Exhibit 1-8212
  13. Aft Tunnel Cooling Fan
    1. Description
    2. Examination
    3. Determination

Ventilation, Cooling, and Recirculation Fans

Electrical fans are used to ventilate and cool the avionics and the centre accessory compartments; to ventilate the galleys, lavatories, and the forward and aft cargo compartments; to recirculate cabin air; and to supply cooling air to the individual seat locations.

Examination

The following five fans share PN 034964:

  1. Aft chiller ventilation fan
  2. Avionics compartment cooling fan
  3. CAC Cooling Fan 1
  4. CAC Cooling Fan 2
  5. Forward chiller ventilation fan

All of the above fans were recovered and identified except for the forward chiller ventilation fan.The damage to the fans was used for comparative analysis to determine the operational state of the fans at the time of impact. The operational state of the fans was subsequently used to determine the electrical condition of the aircraft at the time of impact.

Determination

The following aircraft electrical buses were determined to have been electrically powered at the time of impact:Table: Electrical Buses Powered at Time of Impact

Electrical Bus Fan
115 V AC Bus 1 CAC Cooling Fan 1
115 V AC Bus 2 Avionics compartment cooling fan

Based on the examination of the cabin air recirculation fans, it was also determined that 115 V AC Bus 1 or Bus 3 or both were electrically powered at the time of impact.

Aft Chiller Ventilation Fan

Description

The aft chiller ventilation fan is located in the rear of the aircraft in the aft wall of Lavatory J. The fan is powered by the 115 V AC Bus 3 through the aft chiller vent fan relay. The aft chiller ventilation fan relay is controlled by a ground sensing relay that limits the operation of the fan to ground operations.

Examination

The fan was recovered intact and contained within its mounting structure. The fan was identified by tag as EG&G Rotron PN 034964, SN AFN377. The outer housing wall exhibited minor rotational scuff marks in the blade tip path. Some minor aircraft debris was also noted downstream of the blades.

Determination

Its location was determined by its mounting structure and by its description in the MD-11 Maintenance Manual (Company Edition). Because the aft chiller ventilation fan is only powered on the ground, the minor rotational damage is consistent with the fan being rotated during impact by the ingestion of water and debris.

Avionics Compartment Cooling Fan

Description

This fan, also known as the avionics compartment flow balancing fan, is located below the floor in the right utility tunnel of the forward cargo compartment at fuselage STA 615. The fan blows cooling air from the tunnel into the avionics compartment. It is powered by the 115 V AC Bus 2 through a 5 A, three-phase CB B1-357 located at position M-11 on the upper main CB panel. The continuous operation of the fan depends on the continuous supply of power to the 115 V AC Bus 2. The fan is rated 2.5 A at 11 500 rpm.

Examination

The fan was recovered as a single unit. It was identified by tag as EG&G Rotron PN 034964, SN A01556, and Swissair ASN 0001, IDN 474986.The fan retained a metal V-shaped band clamp on the fan housing inlet, but the associated ducting had broken away. The fan housing was broken at mid-span, adjacent to the stator blades on the exhaust or fan outlet side (which faces forward in the aircraft). (See photograph of "Avionics compartment cooling fan - fan housing.")The impeller fairing was dented and the bearing housing, located below the fairing, was pulled away from the fan motor. The fan blade impeller and armature had been driven forward approximately 1/8 inch in relation to the outer housing. (See photograph of "Avionics compartment cooling fan - impeller fairing.")Five of the eleven fan impeller blades exhibited varying degrees of damage to the leading edges and one blade had broken away. The inner circumference of the fan housing exhibited two different patterns of rotational marks. (See photographs of "Avionics compartment cooling fan - impeller blades 1–2," "Avionics compartment cooling fan - impeller blades 5–6," "Avionics compartment cooling fan - impeller blades 7–8," and "Avionics compartment cooling fan - impeller blades 9–10."

Determination

Its location was determined by its description in the MD-11 Maintenance Manual (Company Edition). The first pattern of rotational marks on the inner circumference of the fan housing is consistent with contact with the tip of the fan impeller blade in the normal plane of rotation. The second pattern of rotational marks is consistent with contact with the tip of the fan impeller blade in an altered plane of rotation. The altered plane of rotation is consistent with a shift of the armature.The rotational marks on the inner fan housing and the damage to the leading edge of the blade are consistent with a high level of rotational energy of the fan impeller at the time of impact. The damage is consistent with the fan being electrically powered at the time of impact. In order for the fan to be electrically powered, the 115 V AC Bus 2 must have been electrically powered at the time of impact.

CAC Cooling Fans 1 and 2

Description

The two CAC fans are located below the floor in the right utility tunnel at fuselage STA 660, near the aft right hand side of the forward cargo compartment. The fans cool the CAC electrical and electronic equipment by moving cool air from the right utility tunnel into a ventilation manifold. Air from the ventilation manifold is directed into one side of the avionics rack and then out through the top of the equipment. Flow sensing switches in the ventilation ducts continuously monitor the fans' airflow and send inputs to the ESC. If the primary CAC Cooling Fan 1 does not provide a sufficient flow of air to the ventilation ducts, the ESC will engage CAC Cooling Fan 2.

CAC Cooling Fan 1

CAC Cooling Fan 1 is powered by the 115 V AC Bus 1 through a 5 A, three-phase CB B1-270 located at position L-18 on the upper main CB panel. The 115 V AC Bus 1 is connected to CAC Cooling Fan 1 through relay R2-5735, which is controlled by the ESC. The ESC energizes relay R2-5735 to shut off CAC Cooling Fan 1.

CAC Cooling Fan 2

CAC Cooling Fan 2 is powered by the 115 V AC Bus 2 through the 5 A, three-phase CB B1-285 located at position M-18 on the upper main CB panel. The 115 V AC Bus 2 is connected to CAC Cooling Fan 2 through relay R2-5736, which is controlled by the ESC. The ESC energizes relay R2-5736 to turn on CAC Cooling Fan 2.

Examination

CAC Cooling Fan 1

CAC Cooling Fan 1 was recovered as a single unit. It was identified by tag as EG&G Rotron PN 034964, SN A02957, and Swissair ASN 0427, IDN 474986.

The fan retained a metal V-shaped band clamp on the fan housing inlet, but the associated ducting was broken away. The fan housing was broken at mid-span on the exhaust side (which faces aft in the aircraft), adjacent to the stator blades.

(See photograph of "CAC Cooling Fan 1 - fan housing.")

The impeller fairing was not recovered. The fan blade impeller was recovered intact. A light score pattern approximately .090 inches wide was observed around the full circumference of the inner housing.

(See photographs of "CAC Cooling Fan 1 - inner housing," CAC Cooling Fan 1 - impeller blades 11, 1, and 2," "CAC Cooling Fan 1 - impeller blades 3–4," and "CAC Cooling Fan 1 - impeller blades 7–8.")

CAC Cooling Fan 2

CAC Cooling Fan 2 was recovered as a single unit. It was identified by tag as EG&G Rotron PN 034964, SN A04360, and Swissair ASN 0167, IDN 474986.

The fan housing was broken at mid-span on the exhaust side, adjacent to the stator blades and on the inlet side, adjacent to the fan blade impeller. The impeller fairing was not recovered. Although the fan housing was broken and folded over into the rotational path of two of the impeller blades, there were no rotational score marks on the face of the inner housing.

(See photograph of "CAC Cooling Fan 2 - inner housing.")

The tip of one blade exhibited an impact mark that extended to the impeller housing. A gouge mark was noted on the reverse of the housing.

(See photographs of "CAC Cooling Fan 2 - blade tip" and "CAC Cooling Fan 2 - gouge mark.")

The upper main CB panel exhibited no heat damage to the CAC fan CBs.

Determination

CAC Cooling Fan 1

The location of the fan was determined by its description in the MD-11 Maintenance Manual (Company Edition).

The light score pattern approximately .090 inches wide around the full circumference of the inner housing is consistent with marks resulting from rotational contact with the tips of the fan impeller blade.

CAC Cooling Fan 2

The location of the fan was determined by its description in the MD-11 Maintenance Manual (Company Edition).

The alignment of the marks on the tip of the blade is consistent with the fan not operating when the damage to the blade tip occurred.

There was no heat damage to the CAC fan CBs to suggest that the CBs had been thermally activated.

Because the fans are co-located in the aircraft, similar impact damage and rotational marks would be expected if both fans were operating. CAC Cooling Fan 1 exhibited distinct rotational marks on the inner face of the housing resulting from contact with the tips of the fan impeller blade; CAC Cooling Fan 2 exhibited no rotational marks. This damage pattern is consistent with the normal operation of the fans, and indicates that CAC Cooling Fan 1 was most likely operating at the time of impact and that CAC Cooling Fan 2 was not.

The ESC must energize relay R2-5735 to shut off CAC Cooling Fan 1 and energize relay R2-5736 to turn on CAC Cooling Fan 2. In order for CAC Cooling Fan 1 to be on and CAC Cooling Fan 2 to be off, the ESC would have had to have been responding to a normal airflow demand in the ventilation ducts (and therefore not have needed to energize the CAC Cooling Fan 2 relay), or CAC Cooling Fan 2 may not have been powered. The fact that CAC Cooling Fan 1 was operating, however, is consistent with the 115 V AC Bus 1 being electrically powered at the time of impact.

Avionics Compartment Exhaust Fan

Description

The avionics compartment exhaust fan is located in the avionics compartment at fuselage STA 445. The fan removes the exhaust air from the avionics compartment and the ventilation ducts primarily during ground operations. The exhaust air is routed overboard through the avionics venturi valve and into the left utility tunnel through a flapper/exhaust fan check valve. In flight, the FAN CONTROL PRESSURE switch shuts off the exhaust fan and closes the exhaust fan check valve. The suction created from the avionics venturi valve moves the exhaust air overboard.

When the cabin airflow is too low for cabin pressurization, the avionics venturi valve is switched to the CLOSED position, and the avionics compartment exhaust fan is turned on. The avionics compartment exhaust air is then discharged into the left utility tunnel to reduce the airflow overboard. The ESC performs this override function automatically in auto mode. This override function can be made in manual mode by pushing the AVNCS FAN OVRD P/B on the overhead ASC panel. Selection of the DITCHING switch will also close the avionics venturi valve and turn on the avionics compartment exhaust fan.

Examination

The fan was recovered as a single unit. It was identified by tag as Able Corporation PN 29680, SN 253, and Swissair ASN 0049, IDN 474584.

The fan housing and fan impeller blade hub were recovered as separate units. The electric fan motor was not recovered. The fan housing exhibited severe damage.

(See photograph of "Avionics compartment exhaust fan - fan housing.")

The inner fan housing exhibited distinct impression marks in the fan impeller blade tip path.

(See photograph of "Avionics compartment exhaust fan - blade tip path.")

All of the fan impeller blades had broken away from the hub. The hub was deformed and the hub retention bolt was bent and fractured.

Determination

The location of the fan was determined by its description in the MD-11 Maintenance Manual (Company Edition).

The impression marks exhibited on the inner fan housing are consistent with contact with the tips of the fan impeller blade. The lack of rotational smears is consistent with marks being made by a stationary blade. The damage to the hub retention bolt was consistent with a bending overload failure, with no evidence of torsional loading. The damage is consistent with the fan not operating at the time of impact.

Avionics Venturi Valve

Description

The avionics venturi valve is located on the left side wall of the avionics compartment at fuselage STA 445. The valve shuts off the avionics exhaust airflow to prevent it from going overboard. The valve is normally in the OPEN position in flight. It can, however, be switched to the CLOSED position automatically by the ESC when the cabin airflow is too low for cabin pressurization, or manually by selecting the DITCHING switch or pushing the AVNCS FAN OVRD P/B.

Examination

The venturi valve was recovered without its electrical actuator. The valve body was flattened and the valve plate was retained within the body and aligned in a position that would indicate that it was in the OPEN position.

(See photograph of "Avionics venturi valve - valve body.")

There were no marks on the interior valve wall or on the exterior of the valve near the valve override lever.

(See photograph of "Avionics venturi valve - interior valve wall.")

A light, soot-like coloured deposit was noted on the interior walls of both the avionics venturi and the avionics venturi valve.

Determination

The lack of marks on the interior valve wall or on the exterior of the valve near the valve override lever is consistent with the valve plate being in the OPEN position at the time of impact.

Aft Tunnel Venturi Valve

Description

The aft tunnel venturi is located at fuselage STA 1880. The venturi expels air from the right aft tunnel area below the cabin floor and from the right side of the waste tank compartment into the atmosphere. The aft tunnel venturi valve controls the operation of the venturi and is normally in the OPEN position in flight.

Both the aft tunnel venturi valve and the avionics venturi valve receive their electrical commands and power from the ESC and the avionics venturi system control CB B1-1351. When the aft tunnel and the avionics venturi valves are commanded CLOSED, the avionics cooling control relay R2-5241 is energized, and the avionics compartment exhaust fan is commanded ON.

Examination

The aft tunnel venturi valve and actuator were recovered as a unit. The valve body was distorted and the valve plate and manual override lever were captured in a position approximately 30 degrees beyond the CLOSED position.

(See photograph of "Aft tunnel venturi valve - valve body.")

There were marks on the interior valve wall in the CLOSED position and on the exterior of the valve near the override lever. There were no other marks on the interior valve wall. There was a tar-like substance on the interior of the valve wall, downstream of the valve plate, covering an area of approximately 180 degrees around the wall surface. Although the source of the substance could not be confirmed, it appeared to match a substance used to seal the venturi valve to the venturi valve plate.

(See photograph of "Aft tunnel venturi valve - interior valve wall.")

Determination

The marks on the interior valve wall and on the exterior of the valve near the override lever are consistent with the valve being in the CLOSED position at the time of impact and being driven to its captured position at the point of impact. The lack of marks on the interior valve wall is consistent with the valve plate being in the CLOSED position at the time of impact.

Finding the aft tunnel venturi valve in the CLOSED position was unexpected. Since the aft tunnel venturi valve and the avionics venturi valve both receive their electrical commands and power from the same source and it was determined that the aft tunnel venturi valve was in the CLOSED position at the time of impact, the avionics venturi valve should also have been in the CLOSED position.

The determination that the avionics compartment exhaust fan was not operating at the time of impact is consistent with the avionics venturi valve being in the OPEN position. Although the CLOSED position of the aft tunnel venturi valve could have resulted from the selection of the DITCHING switch, no other items operated by the DITCHING switch were determined to be activated at the time of impact.

The aft tunnel and avionics venturi valves were examined on another Swissair MD-11 aircraft, HB-IWA, during the aircraft's second "D check" on 7 November 2000. The aft tunnel venturi valve was in the CLOSED position and the avionics venturi valve was in the OPEN position, the same condition that existed on HB-IWF (the occurrence aircraft). According to SR Technics and Boeing, the aft tunnel venturi valve was installed by SR Technics under a service bulletin issued by Boeing. During their inspection of HB-IWA, SR Technics discovered that the pin wiring in the electrical connection for the aft venturi valve had been reversed during installation. SR Technics subsequently conducted a fleet inspection of their remaining MD-11 aircraft and found no further anomalies with the aft tunnel venturi valve. It is suspected that the same mis-wiring occurred on HB-IWF.

Avionics Rack Cooling Fans

Description

There are two avionics rack cooling fans located in the avionics compartment at fuselage STAs 297 and 303.

Examination

Only minor pieces of the cooling fans were recovered and identified.

Determination

An assessment of the operational state of the fans at the time of impact could not be made based on the recovered pieces.

Forward Cargo Compartment Ventilation Fan

Description

The forward cargo compartment ventilation fan is located below the cabin floor in the right utility tunnel of the forward cargo compartment at fuselage STA 695. The fan moves air from below the floor of the forward cargo compartment through a hinged ventilation check-valve into the forward cargo compartment near the ceiling area, which is directly in line with the forward cargo compartment smoke and heat detectors. The fan is turned on when the forward cargo compartment temperature selector is turned on. It is designed to operate continuously under normal operations. The MSC will shut the fan off upon activation of a forward cargo smoke or fire detector.

The fan operates at 900 CFM. It is an electrically operated, 115 V AC three-phase fan. The fan is powered by the 115 V AC Bus 3 through CBs B1-1638, B1-1639, and B1-1640 on the right forward cabin CB panel. The 115 V AC Bus 3 is connected to the forward cargo compartment ventilation fan through relay R2-78, which is also on the right forward cabin CB panel. The relay is powered by the 28 V DC Bus 1 through CB B1-239 at position P18 on the upper main CB panel. The relay is controlled automatically by the MSC and must be energized to operate the fan. The relay can be de-energized manually to shut off the fan by pushing the FWD FLOW P/B on the cargo fire panel.

Examination

The fan housing was recovered as a single unit. It was identified by tag as Preco PN 23-26776, SN FA601221.

(See photograph of "Forward cargo compartment ventilation fan
- fan housing
.")

The fan housing was flattened. One fan impeller blade was trapped inside the flattened housing.

(See photograph of "Forward cargo compartment ventilation fan - inner housing.")

The fan housing exhibited a series of blade tip profile marks around the inner circumference of the fan. The marks were highlighted by an absence of paint on the housing. Another set of blade tip profile marks ran parallel to the fan stator blades.

(See photographs of "Forward cargo compartment ventilation fan - blade tip profile marks" and "Forward cargo compartment ventilation fan - blade tip alignment.")

The fan impeller blade exhibited no rotational damage or scratches on the leading edge or on the tip of the blade.

(See photograph of "Forward cargo compartment ventilation fan - blade tip.")

The electrical motor was not recovered.

Determination

The location of the fan was determined by its description in the MD-11 IPC.

Based on the location of the blade tip profile marks around the inner circumference of the fan, it was determined that the marks were made in the painted surface by the tips of the fan impeller blade while they were stationary. The lack of rotational marks on the leading edge or on the tip of the fan impeller blade is also consistent with the fan not operating at the time of impact.

The determination that the fan was not operating could have resulted from one of the following conditions:

  • The fan was not receiving electrical power.
  • The fan was responding to an input from the MSC as a result of activation of a forward cargo smoke or fire detector.
  • The fan was responding to a crew selection of the FWD FLOW P/B on the cargo fire panel.

Both the 115 V AC Bus 3 fan CBs and the 28 V DC Bus 1 that supply power to the fan are mounted on the right forward cabin equipment panel, in an area of heat and fire damage. The fan relay control power wire runs through an area of heat from the relay to CB B1-239, located on the upper main CB panel. A loss of power to the relay or the thermal tripping of the CBs resulting from fire damage could account for the shutdown of the fan.

The cargo compartment floor area, the source of the fan's air supply, is connected by the cargo compartment sidewalls to the left and right tunnel areas. Air from the forward avionics compartment, which was determined to have contained smoke (as evidenced by the contamination of the avionics compartment radio rack air filter), is discharged either into the left tunnel area or overboard through the avionics venturi valve. Based on the determination that the avionics venturi valve was in the OPEN position at the time of impact, most, if not all, of the smoke-filled discharge air from the avionics compartment should have been directed overboard through the venturi valve. If some of the smoke-filled air were to be directed to the tunnel areas (i.e., past the check valve in the avionics compartment exhaust duct, or as a result of a breach in the Galley 3 chiller input duct drawing smoke from above Galley 3 down the right side and into the left right tunnel area), then smoke could have been drawn into the forward cargo ventilation fan intake area below the cargo floor and discharged directly at the forward compartment smoke and heat detector. Activation of the smoke or heat detector could also account for the shutdown of the fan.

Crew selection of the FWD FLOW P/B on the cargo fire panel cannot be ruled out. Regardless of crew action, however, the fan would have likely shut down owing to the heat or smoke generated by the fire.

Aft Cargo Compartment Ventilation Fan

Description

The aft cargo compartment ventilation fan is located below the aft cargo compartment floor at fuselage STA 1921. The fan moves air from below the floor of the aft cargo compartment, through a Y-shaped pipe, and past two hinged ventilation check valves, into the aft cargo compartment along the left and right outside walls. The fan is activated when the aft cargo compartment temperature selector is turned to the ON position. It is designed to operate continuously under normal operations. The MSC will shut the fan off upon activation of an aft cargo smoke or fire detector.

The fan operates at 300 CFM. It is an electrically operated, 115 V AC three-phase fan. The fan is powered by the 115 V AC Bus 1 through CBs B1-1641, B1-1642, and B1-1643 on the right forward cabin CB panel. The 115 V AC Bus 1 is connected to the aft compartment ventilation fan through relay R2-5678. The R2-5678 is powered by the 28 V DC Bus 3 through CB B1-243 at position S18 on the upper main CB panel. The relay is controlled automatically by the MSC and must be energized to operate the fan. The relay can be de-energized manually to shut off the fan by pushing the AFT FLOW P/B on the cargo fire panel.

Examination

The fan was attached to a section of the lower aft fuselage. It was identified by tag as Able Corporation PN 29480, SN 0008.

(See photograph of "Aft cargo compartment ventilation fan.")

The fan housing was severely corroded as a result of its immersion in salt water; in some areas, the housing was completely corroded through.

(See photograph of "Aft cargo compartment ventilation fan - fan housing.")

The interior of the fan housing adjacent to the running path of the fan blades was also severely corroded. One area where the surface coating remained, however, exhibited minor rotational scratches.

(See photograph of "Aft cargo compartment ventilation fan - inner housing.")

The fan impeller was intact and the fan blades exhibited no leading edge or impact damage.

(See photograph of "Aft cargo compartment ventilation fan - fan blade.")

Determination

The location of the fan was determined by its description in the MD-11 Maintenance Manual (Company Edition).

It was determined that the minor rotational scratches on the fan housing resulted from contact with the tips of the fan impeller blade. The marks are consistent with the fan impeller rotating at the time of impact. Owing to the severe corrosion, however, an assessment of the operational state of the fan at the time of impact could not be made.

Cabin Individual Air Fan

Description

The cabin individual air fan is located at STA 990 Y axis (–24 X axis). The fan supplies ceiling air to the individual seat air outlets; it does not provide air to the conditioned air system. The individual air fan is powered by the 115 V AC 3 right mid-cabin bus through CBs B1-324, B1-325, and B1-326. It is controlled through relay R2-198 in the right mid-equipment panel. Relay R2-198 is powered by the 115 V AC 3-phase A CB B1-1956 in the upper main CB panel at position N-08. The R2-198 is controlled through the Galley 3 slave relay. Relay R2-198 would be shut down as a result of a loss of Galley 3 power, the selection of the CABIN BUS switch, or the selection of the SMOKE ELEC/AIR selector to the 3/1 OFF position.

Examination

Four unidentified fans were recovered. None of the fans could be identified as the individual air fan or a recirculation fan, nor could they be matched to a particular location.

Determination

As none of the fans could be positively identified, no determination could be made for this fan.

Cabin Air Recirculation Fans

Description

The aircraft is equipped with four identical cabin air recirculation fans and one cabin individual air fan. The cabin air recirculation fans are numbered 1 through 4 and are installed at the following locations:

Table: Location of Cabin Air Recirculation Fans

Fan Y Axis Z Axis X Axis
Fan 1 STA 685 100 28
Fan 2 STA 725 100 28
Fan 3 STA 1009 100 28
Fan 4 STA 1109 100 28

Fans 1 and 3 are powered by the 115 V AC Bus 1 and fans 2 and 4 are powered by the 115 V AC Bus 3. The fans are controlled by relays that receive power through the ESC. Galleys 1 and 3 master and slave relays must be powered in order for the fan relays to be energized. Galley 1 master and slave relays control fans 1 and 3 and Galley 3 master and slave relays control fans 2 and 4.

The cabin air recirculation fans are designed to be shut down by

  • selecting the CABIN BUS switch;
  • selecting the ECON switch;
  • selecting the SMOKE ELEC/AIR selector;
  • the ESC in response to a demand for lower cabin temperature; and
  • de-energizing galleys 1 and 3 master and slave relays in response to a generator overload.

Examination and Determination

Four of the five fans were recovered. None of the recovered fans could be identified as either a recirculation fan or the individual air fan, nor could they be matched to a particular location.

Recovered Fan Exhibit 1-2467

Exhibit 1-2467 Examination

This fan was recovered as a single unit. It was identified by the MD-11 IPC as PN 605457-8.

(See photograph of "Recovered fan - Exhibit 1-2467.")

Etched into the housing body was PN 605138-3 R (code ident) 70201. The hub of the composite centrifugal impeller was attached to the motor. The impeller blades and outer periphery of the impeller, however, had broken away. The flanged end of the motor housing assembly had also broken away. Deep rotational gouge marks were noted in two locations on the underside of the impeller. One gouge mark aligned with the outer periphery of the b Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003

Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

  1. Engine Shutdown Systems Description
    1. Normal Engine Shutdown
    2. Emergency Engine Shutdown
  2. Engine Shutdown Systems Examination
    1. Engines 1 and 3
    2. Engine 2
  3. Engine Shutdown Systems Determination
    1. Engines 1 and 3
    2. Engine 2
  4. Engine False Fire Warning

Engine Shutdown Systems Description

Normal Engine Shutdown

The engine FMU allows for starting and shutting down the engine according to the FUEL switch position. There is one FUEL switch for each engine, located beneath the engine throttle on the ENG START panel. Each engine FUEL switch is identical in operation. The Engine 2 FUEL switch is described below.

Engine 2 FUEL Switch

When the FUEL switch is selected to the ON position, 28 V DC battery bus power from CB B1-122, at position B-12 on the overhead panel, is supplied to the fuel open solenoid in the FMU through Pin A2 on the Engine 2 fuel valve open relay, R2-5087. With the activation of the fuel open solenoid, fuel from the engine-driven fuel pump is allowed to enter the FMU. The FMU is equipped with a pressure-sensitive, internal fuel shut-off valve. When the fuel shut-off valve senses a rise in fuel pressure, the valve is moved to the "fuel on" position and the ground to relay R2-5087 is removed. As the FMU shut-off valve is a hydraulically latched valve (which needs fuel pressure to move it), the valve remains in the "fuel on" position as long as fuel pressure to the FMU is present. With the loss of the ground circuit, relay R2-5087 returns to its normal, closed position, and power is removed from the FMU open solenoid valve. As no electrical power is required to hold the FMU fuel shut-off valve open or closed, the use of the relay and valve helps reduce the electrical load on the battery. A loss of electrical power to the FUEL switch with the engine running will have no effect on engine operation.

When the FUEL switch is selected to the OFF position, 28 V DC battery bus power from CB B1-122, at position B-12 on the overhead panel, is supplied to the FMU fuel close solenoid through Pin A3 on the Engine 2 fuel valve closed relay, R2-5088. Fuel is shut off to the FMU and, with a loss of fuel pressure, the internal FMU fuel shut-off valve moves to the "fuel off" position. To limit the current draw on the battery, relay R2-5088 is equipped with a five-second time delay. The current draw on the fuel valve closed relay is lower than the current draw on the FMU fuel close solenoid and, once five seconds have elapsed, the relay opens and power is removed from the fuel close solenoid. As the FMU fuel shut-off valve is a hydraulically latched valve, the valve remains in the fuel off position.

With the FUEL switch in the ON position, power from CB B1-122 is also routed to the X coil of the magnetically latching relay R2-5089, "Engine 2 FADEC Reset," located in the right overwing cabin equipment panel. This opens closed contacts C2-C3 and D2-D3 of R2-5089, removing the ground circuits to channels A and B of the FADEC EEC. When the FUEL switch is placed in the OFF position, the X coil of R2-5089 is de-energized and the Y coil of relay R5-5089 is energized, resulting in the contacts C2-C3 and D2-D3 closing, completing a circuit through the FADEC EEC to ground, resetting the FADEC.

For the FADEC to reset without moving the FUEL switch, two failures need to occur. Power has to be removed from the X coil of R2-5089 by opening the circuit and then power has to be applied to the Y coil to effect its movement to again change the contact positions. It is also possible to reset the FADEC EEC downstream of the R2-5089 relay by shorting the signal wires from R2-5089 to the FADEC EEC.

The only circuit that passed through an area of burn damage is the power wire from CB B1-122 on the overhead panel. This wire is routed out the left side of the overhead tub in wire run AML to the left overhead disconnect panel, and then down the left side into the avionics compartment in wire run AAG. The wiring for the FUEL switch is located in the thrust control module in the pedestal under the floor and is routed aft to station 1059, where it transitions above the floor to the mid overhead cabin. The opening of the power wire, or the tripping of CB B1-122, will prevent the shutdown of Engine 2 and the resetting of the FADEC EEC Channel B.

Emergency Engine Shutdown

The emergency shutdown of each of the three engines is accomplished through three independent ENG FIRE handles located on the flight compartment overhead centre panel. The initial movement of the handle shuts off its respective generator through a generator field disconnect switch. Further movement of the handle rotates a drum and cable assembly that mechanically shuts off the hydraulic system for the engine, by closing its respective hydraulic shut-off valve. The handle can be pulled and rotated in this position to discharge the engine fire bottles. Full movement of the Number 2 ENG FIRE handle also mechanically closes two fuel fire shut-off valves, through rotation of the drum and cable assembly. The forward fuel fire valve is located in the left wing and the aft fuel fire valve is located in the tail. Full movement of fire handle 1 or 3 shuts off the fuel to their respective engines by electrically closing the engine's fuel fire valve.

Engine Shutdown Systems Examination

Engines 1 and 3

The gate valve was identified through the MD-11 Engine Fuel Supply IPC illustration as coming from either the Engine 1 or the Engine 3 position (both valves have the same PN). The valve was recovered with the valve slide gate near the fully closed position. Fibrous material was noted under the edge of the slider, but was not trapped. The motor/actuator was broken off and the splined male and female drive were missing. There was a circumferential fracture at the bottom of the female spline. The fracture showed signs of shear failure at one side (around the outside surface of the remaining stub) and an impression of the male spline at the other end. The impression made by the male spline implied a bending failure, associated with a clockwise torsional rotation on the compression side. There was also some smearing and indentation of the casing alongside the shaft, 90 degrees to the bending direction of the shaft. The torsional nature of the shaft fracture and the smearing of the casing alongside the shaft indicates that the initial bending failure likely occurred when the shaft was oriented near the valve open position, and that the shaft was rotated toward the valve closed position as the shaft was broken off.

A second gate valve was recovered and identified through the MD-11 Engine Fuel Supply IPC illustration as coming from either the Engine 1 or the Engine 3 position. Only the upper portion of the valve slide gate body was recovered. The motor/actuator was broken off and the four motor/actuator attachment posts were bent over in a clockwise rotational pattern. The splined female drive and valve slide arm remained within the body, with the slide arm captured in the valve slide closed position. The clockwise rotational bending pattern on the motor/actuator attachment posts is consistent with failure of the motor/actuator in a direction that would bias the valve slide arm toward the closed position during impact. Based on the knowledge that engines 1 and 3 were operational at the time of impact (STI) and the failure mode of the valve, it is believed that the valve was in the open position at the time of impact.

The hydraulic shut-off ball valve was identified by tag as Whittaker Controls, Inc. PN 148885-1, SN 2332. The valve lever arm assembly was identified by design through the MD-11 IPC as coming from either the Engine 1 or the Engine 3 position. A section of push rod was still attached to the valve lever arm. As recovered, the ball was aligned in the valve open position, but was free to rotate. The valve position-indicator pointer attachment pin was sheared and it appears to have been forced against the open position stop. It could not be established whether the valve had moved during the impact sequence.

Engine 2

The forward fuel fire shut-off valve (located in the trailing edge of the left wing) was identified through the MD-11 IPC by a section of attached pipe, PN AAL7000-501. The mechanically operated gate-type valve was identified by tag as PN AV16A1348B, SN N60100. The valve gate was recovered in the closed position. The actuating handle, which is connected to the cable assembly through a link rod and cable drum, was broken off. The closed position stop was "overridden" by a smear that progressed past the stop by approximately 3/8 inch. The internal boss, housing the actuator lever, exhibited a heavy gouge that started midway between the open and closed stop positions, and progressed past the closed stop to the "overridden" position. This gouge indicates that the valve was most likely open at the time of impact and driven closed by impact forces.

The Engine 2 aft fuel fire shut-off valve was still attached to a piece of the tail structure. The valve was identified by tag as PN 233865-1, SN 035. The valve was removed from the structure and the valve slide gate was found in the open position. The valve body actuating arm was at the open stop position, and there was no damage to the stop plate. The end of the valve body actuating arm had broken off at the rig pin hole, from an impact that imparted a side bending load on the arm and captured the actuating arm in place. The valve slide end plate had received an impact that sheared three of its four mounting screws and twisted the plate to the side. The internal bore of the plate had a gouge from contact with the end of the valve slide, with the slide in the open position. The recovered position of the gate valve and the associated damage to the actuating arm and the valve end plate indicates that the valve was most likely in the open position at the time of impact.

The hydraulic shut-off ball valve was identified by tag as Whittaker Controls, Inc. PN 148885-1, SN 2279. The valve lever arm assembly was identified by design through the MD-11 IPC as coming from the Engine 2 position. A section of push rod was still attached to the valve lever arm. As recovered, the ball was aligned in the valve open position, but was free to rotate. The valve position-indicator pointer attachment pin was sheared, and it appears to have been forced against the open position stop. It could not be established whether the valve had moved during the impact sequence.

Engine Shutdown Systems Determination

Engines 1 and 3

The recovered open position of the Engine 1 or Engine 3 hydraulic shut-off valve was consistent with the open positions of the two engine fuel fire shut-off valves and the results of the engine examinations, which indicated that engines 1 and 3 were operating at the time of impact.

Engine 2

The recovered open position of the Engine 2 hydraulic shut-off valve was consistent with the open positions of the Engine 2 forward and aft fuel fire shut-off valves, in that all three valves are operated together by the engine fire handle. Pulling the engine fire handle would have closed all three valves.

Fire in the cockpit ceiling area could have resulted in damage to the engine fire cabling pulley cluster, creating enough slack in the cabling that pulling the Engine 2 fire handle would have no effect on closing the engine fuel fire and hydraulic valves. Since the valves were open, it follows that the Engine 2 shutdown could not have occurred as a result of pulling the engine fire handle.

Engine 2 was determined to have been shut down by crew activation of the Engine 2 FUEL switch, for the following reasons:

  1. The engine examination and FADEC information supports the shutdown of Engine 2 before the time of impact.
  2. Examination of the Engine 2 emergency shutdown system (forward fuel shut-off valve, aft fuel shut-off valve, and hydraulic shut-off valve) indicates that the cable-operated system could not have shut down the engine.
  3. The Engine 2 FADEC NVM data indicates that a re-initialization of the EEC occurred. This can only be accomplished through the FADEC reset relay, which is controlled by the selection of the engine FUEL switch (to OFF), with electrical power available from the 28 V DC battery bus.
  4. The engine FMU is equipped with a hydraulically latched fuel shut-off valve. No electrical power is needed to keep the FMU fuel shut-off valve open; therefore, a loss of electrical power to the engine FUEL switch would not have resulted in the shutdown of the engine.
  5. The assessment that the Tank 2 right aft boost pump was not running (the operation of remaining Tank 2 pumps was uncertain) is consistent with the fuel system controller in the auto mode, responding to a shutdown of Engine 2 with the Engine 2 FUEL switch. The FUEL switch is equipped with a separate set of switch contacts to signal the fuel system controller to shut down the fuel pumps in the corresponding tank.

Engine False Fire Warning

The ground wire for the Engine 2 fire handle lights is co-located in wire bundle AMK, which had known arcing events (Engine 2 fire detection loop "A" and high-intensity light wires). If this ground wire were to short to ground at some point along its run, then both the Engine 2 fire handle light and the Engine 2 FUEL switch light would have illuminated.

One of the two cockpit crew emergency checklists was found with fire damage to the front of Page 3 and the back of Page 2 (the checklist was recovered in the closed position). Page 3 of the checklist is the Engine Fire page. The first checklist item on the Engine Fire page is to move the throttle to idle, followed next by the movement of the engine FUEL switch to OFF. The Engine 2 FUEL switch was moved to the OFF position. The fire damage to the checklist could imply that the checklist had been opened to Page 3, and the fact that one of the first checklist action items (when dealing with an engine fire) is to move the FUEL switch to OFF, brings some credit to the theory that the crew could have been responding to an engine fire warning alert.

If the crew had shut down Engine 2 because of a fire warning indication, and had been following the checklist, then the Engine 2 fire handle should also have been pulled and at least one of two Engine 2 fire bottles discharged. Examination of the Engine 2 cable-driven fuel fire shut-off valves and the Engine 2 fire bottles revealed that the valves had not been moved nor had the fire bottles been discharged. It is not known to what extent the engine fire cable pulley cluster, in the cockpit ceiling area, was damaged by the on-board fire. If the phenolic pulleys were damaged by the fire such that the cables became slack, then it is possible that pulling the Engine 2 fire handle would have had little or no effect in closing the engine fuel fire shut-off valves (as moving the handles would only remove the slack in the cabling). However, slack in the cabling (if present), would not have prevented the crew from discharging the fire bottles. The fact that the shutdown of the engine occurred in the latter stages of the flight, just prior to impact, is consistent with the crew members having little time, in a hostile environment, to complete the engine shutdown, even if they had started that procedure.

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

Environmental Systems

  1. Environmental Systems
    1. Description
  2. Air Conditioning System
    1. Description
  3. Ram Air Cooling
    1. Description
    2. Examination
    3. Determination
  4. Conditioned Air Manifold
    1. Examination
    2. Determination
  5. Fan Air (Heat Exchanger) Plenums
    1. Description
    2. Examination
    3. Determination
  6. Pneumatic System Isolation Valves
    1. Description
    2. Examination
    3. Determination
  7. Air Packs
    1. Examination
      1. Air Pack 1
      2. Air Pack 2
      3. Air Pack 3
    2. Determination
      1. Air Pack 1
      2. Air Pack 2
      3. Air Pack 3
  8. Air Duct Temperature Sensors
    1. Examination
    2. Determination

Environmental Systems

Description

The environmental systems are powered by pneumatic air pressure, which is supplied by either the engines, the APU, or ground sources. This pressurized air is used to operate the following systems:

  • Air conditioning and pressurization
  • Engine starting and engine anti-ice
  • Wing and stabilizer anti-icing
  • Cargo heating
  • Potable water pressurization
  • Avionics cooling

Air Conditioning System

Description

The MD-11 is equipped with three air conditioning packs (air packs).[1] Air packs 1 and 2 are co-located in the air conditioning/wheel well compartment at the forward end of the aircraft, to the left of the nosewheel well. Air Pack 3 is located on the right side, across from air packs 1 and 2. All three air packs supply a common, conditioned air manifold, which is located below the cabin floor. The air packs feed this manifold through three check valves. Air from the conditioned air manifold is directed through ducts, upward along the left and right side walls of the aircraft (behind the cockpit rear walls) and then through duct work to the five individually controlled zones in the aircraft. One duct from the manifold is dedicated to supply the cockpit only.

Hot pneumatic bleed air to each air pack is passed through a pneumatically actuated flow control valve. The flow control valves are spring-loaded to the closed position; that is, with a loss of pneumatic supply pressure, the valve will close. The flow control valve normally operates at 35 psig, but the ACC,[2] which regulates the air pack temperature and flow functions, can reduce the pressure to meet system demands through the use of an electrically operated torque motor located in the valve. If the ACC cannot control flow rate with the flow control valve (because of a failure), it sends a signal to the related pneumatic system controller. This causes the pressure regulator valve to modulate, and act as a backup means to regulate the air pack temperature and flow functions.

With a loss of electrical power, the flow control valves will modulate pneumatically to regulate air pack operation. To shut down an air pack with an operating pneumatic source, the torque motor has to be electrically driven to close the valve. The torque motor on Air Pack 3 flow control valve is electrically powered by the battery bus, through CB B1-347, at location C-11 on the overhead CB panel.

Air Pack 3 can be shut down manually, through push-button selection on the ASCP or by rotation of the SMOKE ELEC/AIR selector (to the 2/3 position). The air pack can also be shut down automatically by the ACC, as a result of a manifold failure or the air pack overheating. In the event of a pack overheat condition shutting down the air pack, the pack ram air doors will remain open.

There are two pneumatic system isolation valves, identified as Isolation Valve 1-2 and Isolation Valve 1-3. They are installed in the pneumatic supply duct work, upstream of the air packs, in the centre accessory compartment. In case of a pneumatic supply system problem or an engine failure, these valves provide for an alternate supply of air to the air packs, from an active pneumatic system to an inactive one. The valves are normally kept closed by the ESC and will open when the ESC senses a need to bleed air from one system to another.

Operation of the air conditioning system is controlled automatically by the ESC in the auto mode or manually by push-button selection on the ASCP with the ESC in manual mode.

Ram Air Cooling

Description

The ram air cooling system supplies metered outside air to each of the three air pack heat exchangers and composite plenum assemblies. The air is then dumped overboard through an exhaust door. The flow of cooling air to the heat exchangers is controlled by the positioning of three ram air inlet and exhaust doors. The efficiency of the heat exchanger is affected by the amount of cooling ram air that passes across the bleed air tubes in the heat exchanger. The ram air inlet door assemblies are located on the lower side of the forward fuselage, forward of the air packs. Two inlet doors are located on the left side of the fuselage to supply air packs 1 and 2, and one inlet door is located on the right side of the fuselage to supply Air Pack 3.

A ram air door actuator is connected to each of the exhaust doors, which in turn are interconnected to their respective inlet doors by a push/pull cable arrangement. The ram air door actuators are electrically operated jack screws that move in response to signals from their respective ACCs and the ESC. The actuators extend to close the doors and retract to open the doors. When an air pack is shut down by operation of the SMOKE ELEC/AIR selector or by push-button selection on the ASCP (in manual mode), the ACC will close the air pack's corresponding ram air inlet door. If the air pack is shut down by the ACC because of a fault (i.e., if the pack temperature exceeds 180°C), the ram air door will remain open. The ram air door actuators are electrically powered by the left emergency 115 V AC bus through CBs B1-351, B1-352, and B1-353 at locations F-07, F-08, and F-09 on the overhead CB panel.

Examination

All three ram air inlet door assemblies were recovered; however, they could not be matched to specific air packs. An examination of the door assemblies exhibited water impact marks on the interior of all three flap assembly housings. Of the three ram air door actuators, only the actuator from Air Pack 3 was recovered. The actuator was captured in the retracted, or door-open, position.

(See photograph of "Ram air door actuator.")

Determination

The water impact marks on the interior of all three flap assembly housings were caused by contact with their respective ram air inlet doors. The location of the water impact marks placed two of the ram air inlet doors near the fully open position, and one near the half-open position.

Conditioned Air Manifold

Examination

During the reconstruction and examination of the ram air ducting and the air conditioning ducting—downstream of the air conditioning units to the conditioned air manifold—a black soot-like material was noted on the inner surface of the duct walls. The outer surface of the walls showed no signs of heat discolouration. Another Swissair MD-11 aircraft, HB-IWA, was inspected during its second "D check;" it too exhibited the same material adhering to the inner surfaces of the ducts. Swissair was asked to provide photographs and swab samples of the interior of the air conditioning duct work downstream of the air packs from one of their MD-11 aircraft in service.

No signs of fire or overheat damage were observed within the conditioned air duct work below the cabin floor.

Determination

The photographs and swab samples provided by Swissair were consistent with the material noted on the duct work of the accident aircraft. As a result, the manufacturer of the air pack component, Allied Signal, was consulted. The soot-like material was determined to be a normal bi-product of dust particles that impinged on the duct walls after coalescing with water from condensation within the air conditioning units.

Fan Air (Heat Exchanger) Plenums

Description

Ram air that has been heated by passing through the heat exchangers is directed overboard by the fan air plenums. The plenums are constructed from a phenolic resin/fibreglass composite material that is black when assembled.

Examination

The phenolic resin fibreglass composite material had whitened on some of the recovered pieces of the plenums, leaving only the fibreglass cloth, without the phenolic resin. No charring of the plenum material was found. These pieces were examined by the manufacturer of the component, Allied Signal, who found a change in colour and resin loss in the plenum samples.

The mating heat exchangers from the three air packs were also examined for exposure to heat.

Determination

The change in colour and resin loss in the plenum was consistent with the normal "baking out" or evaporative loss of the resins over the long service life of the plenum (in this instance more than 30 000 hours in service). Allied Signal conducted oven and burner tests on samples of new composite plenum material. The results of the oven test showed that when the samples were heated to 232°C (450°F) in a circulating oven for 500 hours (a temperature consistent with the normal operating temperatures associated with air pack operation), there was a 7% weight loss in the composite samples. The loss in weight was determined to be from the evaporative loss of the cured phenolic resin.

During testing, the composite material burned when subjected to an open flame; however, combustion stopped once the flame was removed. The burned sample appeared charred, unlike the material that was recovered from the crash site, indicating that the recovered material had not been exposed to fire.

The heat exchangers are made of aluminum, and would exhibit some evidence of a fire, had it been present. It was determined that the heat exchangers were not exposed to excessive heat.

Pneumatic System Isolation Valves

Description

The pneumatic system isolation valves are a electrically actuated, butterfly-type shut-off valves. The electrical actuator is attached to the body assembly and contains two independent motor and planetary reduction gears. Either of the motor/gear sets can drive the differential planetary reduction gears to rotate the butterfly shaft. When the butterfly shaft rotates, it turns the butterfly plate and operates the position indicator and limit switches. If voltage is removed during valve operation, the valve stops and stays in that position. The valves can be manually positioned (during maintenance) by rotating an override knob on the electrical actuator. The override knob requires approximately 20 rotations to move the valve through the full range.

The ASCP has two switch-lights for control of the isolation valves. The ESC illuminates the correct light to indicate the following valve conditions: ON, to show that the ESC issued a valve-open command; and DISAG, to show that the valve's position disagrees with the commanded position. When the ESC is in auto mode, the switches on the ASCP are not active. When the ESC is in manual mode, pushing the switches will command the valves alternately open or closed.

Examination

One of the two isolation valve electrical actuators was recovered and was identified by a data plate as AiResearch PN 544964-1, SN 49-1957. The actuator had broken free of the valve body assembly, which was not found. The actuator was heavily damaged; both electrical drive motors had been broken off and were not found. The actuator indicator, which is driven by the internal planetary gears, was aligned slightly beyond the closed position mark on the actuator body. The manual drive override knob had been broken away from its mounting shaft, and the shaft appeared to have been rotated from the closed position to slightly beyond the closed position at the time of impact.

(See photograph of "Isolation valves")

The second isolation valve electrical actuator was recovered; however, its data plate was not found. The actuator had broken free from the body assembly; the valve body assembly was not found. The actuator was heavily damaged; both electrical drive motors had been broken off and were not found. The actuator indicator, which is driven by the internal planetary gears, was aligned with the closed position mark on the actuator body. The manual drive override knob was heavily damaged. A scratch on the actuator body aligned with a sheared edge of the override knob.

Determination

Since the serial numbers of the isolation valve actuators were not recorded in the aircraft's technical records, it could not be determined whether the first isolation valve electrical actuator recovered corresponded to Isolation Valve 1-2 or Isolation Valve 1-3. The valve was determined to be in the "valve closed" position at the time of impact.

The alignment of the marks on the actuator body of the manual drive override knob on the second isolation valve electrical actuator indicates that the knob was likely in the "valve closed" position when the damage occurred and had not moved subsequently.

Air Packs

Examination

All three air packs were recovered.

The units were heavily damaged and contaminated with silt and salt corrosion products. The air packs were an item of interest since the crew had indicated that they were, initially, using the Air Conditioning Smoke checklist. A team that included representatives from the manufacturers of the aircraft (Boeing) and components (Allied Signal), the airline company (Swissair), and the TSB was assembled to examine the units. The packs were examined for evidence of rotor burst, rupture, or signs of fire or heat that may have been associated with the origins of the on-board fire. The packs were also examined for signs of rotational damage that would indicate whether they had been rotating at the time of impact.

(See photograph of "Three recovered air packs.")

Air Pack 1

Scratches were observed on the turbine and compressor shrouds and wheel assemblies; the flow control valve was found in the partially open position. The turbine exducer blades were folded and the fan blades were sheared. The bearings did not show any signs of having been overloaded and did not exhibit any pre-impact damage. Air Pack 1 did not exhibit fire damage or any internal failure that might have occurred before impact with the water.

Air Pack 2

Scratch marks were observed on the compressor; a rub mark was found on the flow control valve. The turbine exducer blades were bent and fractured, and the fan blades were sheared. The bearings did not show any signs of having been overloaded; however, the material coating on four of the turbine thrust bearing pads exhibited discolouration. Air Pack 2 did not exhibit fire damage or any internal failure that might have occurred before impact with the water.

Air Pack 3

No witness rub marks were noted on the compressor or turbine shroud and wheel assemblies. No physical evidence was found to suggest that the flow control valve was in other than the recovered, closed position. The lock-out blocks were found in the partially engaged position. The turbine exducer blades were folded and the fan blades were sheared. The bearings did not show any signs of having been overloaded and did not exhibit any pre-impact damage. The Air Pack 3 ram air doors and door actuator were found in the open position. Air Pack 3 did not exhibit fire damage or any sign of internal failure that might have occurred before impact with the water.

Determination

Air Pack 1

Scratches on the turbine and compressor shrouds and wheel assemblies indicated that the air pack was most likely operating at the time of impact, which is consistent with the partially open position of the flow control valve. Folding of the turbine exducer blades suggest a high blade loading, possibly from water impingement, as there was no crush damage to cause the deformation. Shearing of the fan blades was most likely a result of a water impact load during separation of the fan inlet.

Air Pack 2

Scratch marks on the compressor indicate that the air pack was most likely operating at the time of impact, but with low rotational energy. This is consistent with the rub mark on the flow control valve indicating that the valve was partially open at the time of impact. Bending and fracture of the turbine exducer blades was most likely a result of high-impact loads caused by the collapse of the turbine shroud during the sudden stoppage. Shearing of the fan blades was most likely the result of an impact load during separation of the fan inlet. Discolouration of the material coating on four of the turbine thrust bearing pads indicated that the air pack was likely subjected to a high operating temperature condition at some time during the life of the unit.

Since Air Pack 2 was running (to a lesser degree than Air Pack 1), and both isolation valves were closed, Air Pack 2 was probably in the stages of spooling down at the time of impact. With the shutdown of Engine 2, there would have been a loss of pneumatic pressure or bleed air from the engine to Air Pack 2. This loss of pneumatic system or duct pressure would have been sensed by the pneumatic system controller and a signal would have been sent to the ESC. With the ESC operating in auto mode, Isolation Valve 1-2 should have opened automatically to allow Engine 1 bleed air to drive Air Pack 2.

The failure of Isolation Valve 1-2 to open in this case implies a loss or interruption of electrical power to the valve. The valve is powered by the right emergency 115 V AC bus through CB B1-311 at position G-25 on the overhead CB panel. The overhead CB panel was damaged by heat and fire, which could have caused a thermal tripping of the CB. The CB was not identified; however, a CB at position F-24 (one row up and one to the left of G-25) was recovered with no soot accumulation on the white insulator (indicating that CB F-24 had not been tripped before impact). The control circuitry for the isolation valve was also routed through an area of high heat and known electrical arcing. If the control circuitry was compromised by the fire, the valve would have remained closed.

If, prior to the engine shutdown, the ESC had been selected to manual mode (as in the case of the Air Pack 3 manual shutdown scenario), Isolation Valve 1-2 would not have opened automatically and would only be commanded open by crew selection. Because the shutdown of Engine 2 occurred in the latter stages of flight (just prior to impact), it is unlikely that the selection of the isolation valve would have been a high priority for the crew, and may not have been possible because of the overhead fire.

Without an alternate supply of bleed air through Isolation Valve 1-2, a spring in the flow control valve would eventually overcome the decreasing pneumatic pressure in the supply duct and close the flow control valve, thereby shutting down the air pack.

Air Pack 3

The lack of witness rub marks on the compressor and turbine shroud indicates that the air pack was not operating at the time of impact. This is consistent with the fully closed position of the flow control valve. The partial engagement of the lock-out block suggests that the valve was in the closed position when the valve body was struck. The folded turbine exducer blades suggests a high blade loading, possibly from water impingement, as there was no crush damage to cause the deformation. Shearing of the fan blades was most likely the result of an impact load during separation of the fan inlet.

The fact that the pneumatic supply source for Air Pack 3 (Engine 3) was operating suggests that the air pack was shut down by an electrical signal to the flow control valve's torque motor from the ACC rather than by a loss of the pneumatic source pressure.

The Air Pack 3 ram air doors and door actuator were found in the open position, which could indicate that the pack was shut down automatically because of overheating, but examination of the air pack revealed no signs of such a condition. The pack temperature outlet sensor (which would sense the overheating) is located in the ductwork in the Air Pack 3 compartment and would not have been influenced by the heat generated by the on-board fire. The possibility of a manifold failure cannot be ruled out; however, because it would require a mechanical failure of the ductwork (below the floor), it is considered unlikely.

The manual shutdown of the air pack is a likely event, as the flight crew were trying to isolate a potential source of smoke (as per the emergency checklist procedures for Air Conditioning Smoke). The shutdown of the air pack would have to have occurred after the loss of the FDR (as no pack shutdowns were recorded). To shut down Air Pack 3, the crew could have used the SMOKE ELEC/AIR selector (in the 2/3 position); however, as the 115 V AC Bus 2 is considered to have been powered at the time of impact, it is unlikely that the air pack was shut down for this reason (since power to the 115 V AC Bus 2 indicates that the SMOKE ELEC/AIR selector was not in the 2/3 position at the time of impact).

The crew could have shut down the air pack manually by push-button selection on the ASCP. The Air Conditioning Smoke checklist calls for the shutting down of Air Pack 1 (as the first event), and then, if the smoke does not abate, the sequential shutting down of Air Pack 3 and Air Pack 2 (while turning on the air pack previously shut down). To activate the pack push buttons, the crew would first have to select the ESC to manual mode. With a manual shutdown of an air pack, the ram air doors would close. For the ram air doors to remain open (as in the case of Air Pack 3), a loss of electrical power to the ram air door actuator would have to occur. The ram air door actuators are powered by the left emergency 115 V AC bus, which was found to have heavy arcing damage to the bus feed wire. If this arcing damage had interrupted electrical power to the door actuator prior to the shutdown of the air pack, then the door would have remained open, its last-selected position.

Battery bus voltage would have been available to the flow control valve to close the valve. The fact that Air Pack 3 had spooled down and was off at the time of impact indicates that the shutdown of the air pack likely occurred as an earlier event within the last six minutes, after the loss of the FDR.

Air Duct Temperature Sensors

The duct temperature dual sensors are paired, thermistor-type sensors in the air distribution ducts of each zone. The cockpit duct temperature sensor is installed in the flight compartment conditioned air distribution duct, on the left side of the avionics compartment at STA 390. The signal wiring between the cockpit duct temperature sensor and ACC 1 and ACC 2 is routed below the floor. The other four sensors are mounted in the forward cabin above the ceiling, with one sensor in each conditioned air distribution duct.

The cockpit zone temperature sensor is located in the temperature ejector, mounted in the ceiling above the cockpit door. The zone temperature sensor signal wire is routed from the ejector, across the forward side of the cockpit wall, to wire run ADD, which originates from receptacle R5-423 on the overhead disconnect panel. The signal wire is attached to this wire bundle and is then routed down the right side of the fuselage, behind the avionics CB panels, to the avionics compartment.

An increase in the duct air temperature will be directly shown on the Air Page. If an overheat condition exists (when the temperature exceeds the overheat setpoint of 87°C for 320 seconds), the digital duct temperature readout changes from white to amber and is boxed amber. If the trim air is turned off, the digits are replaced by a cyan OFF display. This will also generate a Level 1 alert "ZONE TEMP SEL OFF" shown on the EAD, but will not illuminate the AIR cue key on the SDCP. If no valid duct temperature is available, the digits are replaced by an amber X.

For a fire to affect the duct temperature sensors, it would have to impinge directly on the sensor or raise the temperature of the air in the duct. If a fire were to damage and open the duct temperature signal wires, then the duct temperature would be replaced by an amber X.

A fire in the cockpit attic area could affect the zone temperature readout if it caused the signal wires to create an open circuit or if the ejector was damaged by fire enough to cause the separation of the signal wires. If the signal wires were opened, the zone temperature readout on the Air Page would have been replaced by an amber X.

Examination

There was no indication of a fire in the avionics compartment, nor of heating of the conditioned air ducts below the floor.

Part of the temperature ejector was identified; it exhibited heat damage.

Determination

It was determined that fire did not affect the duct temperature sensors.

As the signal wires are all routed below the cockpit floor, it was determined that the fire did not damage the duct temperature signal wires.


[1]    Air packs are also known as refrigeration units or air cycle machines.

[2]    In the context of the environmental systems, the initials ACC refer to the Air Conditioning Controller.

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

Fire Protection System

  1. Portable Fire Extinguisher System
    1. Description
    2. Examination
      1. Recovered Halon Extinguisher Exhibit 1-7150
      2. Recovered Halon Extinguisher Exhibit 1-7151
      3. Recovered Halon Extinguisher Exhibit 1-7152
      4. Recovered Halon Extinguisher Exhibit 1-7153
      5. Recovered Halon Extinguisher Exhibit 1-7154
      6. Recovered Dry Chemical Extinguisher Exhibit 1-7155
      7. Recovered Dry Chemical Extinguisher Exhibit 1-7156
  2. Engine/Cargo/APU Fire Detection and Suppression Systems
    1. General Description
    2. Engine 2 Fire Detection System
      1. Description
      2. Examination
      3. Determination
  3. Firex Bottle Explosive Cartridges Examination

Portable Fire Extinguisher System

Description

There were six Halon 1211 fire extinguishers and two dry chemical fire extinguishers onboard SR 111. Halon extinguishers consist of a cylinder, a valve head, a carrying handle, a locking pin, a nozzle, and a pressure gauge. The dry chemical extinguishers consist of the same components, but have a flexible hose connecting the discharge head and the nozzle. All of the portable fire extinguishers were manufactured by General Fire Extinguisher Corporation. The fire extinguishers are not serialized and no record of their specific location within the aircraft is recorded, nor is there a requirement to do so.

Examination

Five of the six Halon 1211 fire extinguishers and both dry chemical fire extinguishers were recovered. The Halon extinguishers were identified by model GH-2&nbsp1/2 J Halon 1211 and the dry chemical were identified by model TCP5LH.

The fire extinguishers were examined to determine whether they were still charged, to assess their pre-impact charge state, and to determine whether they had been removed from their mounting brackets.

Recovered Halon Extinguisher Exhibit 1-7150

Recovered Halon Extinguisher Exhibit 1-7150 Examination

The cylinder was crushed and the complete valve head assembly (including the trigger, carrying handle, nozzle, pressure gauge, and locking pin) had torn off and was not recovered, leaving a hole in the cylinder. The cylinder weighed 1.90 lb.

(See photograph of "Recovered Halon extinguisher - Exhibit
1-7150
.")

Recovered Halon Extinguisher Exhibit 1-7150 Determination

Damage to the unit precluded determining the pre-impact charge state. Due to the extensive damage to the bottle, it could not be determined whether the bottle was installed in its mounting bracket at the time of impact.

Recovered Halon Extinguisher Exhibit 1-7151

Recovered Halon Extinguisher Exhibit 1-7151 Examination

The cylinder was dented and partially crushed. The head assembly had been torn off and was not recovered, leaving a hole in the cylinder. The model T650554 was visible on the UL label. An inspection date of "11.5.98" was noted on the label along with the Swissair control decal with the alphanumeric combination "35031V-SR" printed on it. The cylinder weighed 2.13 lb. The cylinder exhibited an impact mark in the upper left-hand position.

(See photographs of "Recovered Halon extinguisher - Exhibit
1-7151
, "Recovered Halon extinguisher - Exhibit 1-7151 - impact mark aligned with typical support bracket," and "Recovered Halon extinguisher - Exhibit 1-7151 - impact mark.")

Recovered Halon Extinguisher Exhibit 1-7151 Determination

Based on the position of the impact mark on the cylinder, it was determined that the mark resulted from contact with its mounting bracket. This damage is consistent with the bottle being installed in the mounting bracket at the time of impact.

Recovered Halon Extinguisher Exhibit 1-7152

Recovered Halon Extinguisher Exhibit 1-7152 Examination

The cylinder was dented and the valve head was still attached to the cylinder. The trigger, carrying handle, nozzle, and locking pin were not recovered. The pressure gauge was still attached to the cylinder with the indicator reading at the top of charge zone. The cylinder weighed 4 lb, 8 oz.

To determine whether the extinguisher was still charged, a trigger and nozzle were installed and the fire extinguisher was discharged into a closed system recovery storage tank. A normal discharge occurred, lasting approximately 20 seconds. After discharge the cylinder weighed 2 lb, 8 oz, indicating that 2 lb of Halon had been discharged. The valve assembly was removed after discharge and the interior of the cylinder was examined. The bottom of the cylinder was lightly corroded, the remainder of the interior was clean, and a small amount of liquid Halon was visible inside the cylinder. The cylinder exhibited an impact mark. The discharge nozzle exhibited gouging at the point of contact with the locking pin.

(See photographs of "Recovered Halon extinguisher - Exhibit
1-7152
," "Recovered Halon extinguisher - Exhibit 1-7152 - gouge mark," and "Recovered Halon extinguisher - Exhibit 1-7152 - impact mark.")

Recovered Halon Extinguisher Exhibit 1-7152 Determination

It was determined that the fire extinguisher was charged at the time of impact. Based on the position of the impact mark on the cylinder, it was determined that the mark resulted from contact with its mounting bracket. It was therefore determined that the bottle was installed in the mounting bracket at the time of impact. Based on the gouge marks on the discharge nozzle at the point of contact with the locking pin it was determined that the locking pin was installed at the time of impact. The noted physical damage is consistent with the fact that the fire extinguisher was still charged after impact.

Recovered Halon Extinguisher Exhibit 1-7153

Recovered Halon Extinguisher Exhibit 1-7153 Examination

The cylinder was heavily dented on the bottom and the valve head was still attached but the trigger, carrying handle, nozzle, and locking pin were not recovered. The pressure gauge was at the low end of the overcharge zone. The service and control tags were not readable owing to impact damage. The cylinder weighed 4.64 lb.

To determine whether the extinguisher was still charged, the trigger rivet was removed, a trigger and a nozzle were installed, and the extinguisher was discharged into a closed storage tank. A normal discharge occurred, lasting 18 seconds. The trigger and nozzle were removed and the cylinder weighed 2 lb, 4 oz, indicating that 2 lb, 7 oz, of Halon had been discharged. The valve was removed after discharge and the interior of the cylinder was examined. The interior was clean but the siphon tube was detached from the valve adapter. The cylinder exhibited impact marks at the lower left hand position. The discharge nozzle exhibited no impact marks resulting from contact with the trigger locking pin.

(See photographs of "Recovered Halon extinguisher - Exhibit
1-7153
" and "Recovered Halon extinguisher - Exhibit 1-7153 - impact mark.")

Recovered Halon Extinguisher Exhibit 1-7153 Determination

It was determined that the fire extinguisher was charged at the time of impact. Based on the location of the impact marks on the cylinder, it was determined that the marks resulted from contact with its mounting bracket attachment screw, at the lower left-hand position. This damage is consistent with the bottle being installed in the mounting bracket at the time of impact.

Recovered Halon Extinguisher Exhibit 1-7154

Recovered Halon Extinguisher Exhibit 1-7154 Examination

The cylinder was dented and the valve was still attached. The pressure gauge was loosely attached but the trigger, carrying handle, nozzle, and locking pin were detached. The service and control tags were not recovered. The cylinder weighed 2.18 lb, indicating that the cylinder was empty of Halon.

The valve was removed and the interior of the extinguisher was examined. The bottom and the walls of the cylinder were lightly corroded, which is not unusual. There was a small amount of loose oxide material on the interior of the cylinder. There was no sea water in the cylinder. The siphon tube was loose on the valve adapter. The corners of the valve block, adjacent to where the safety pin would normally sit, were undamaged.

(See photograph of "Recovered Halon extinguisher - Exhibit
1-7154
.")

Recovered Halon Extinguisher Exhibit 1-7154 Determination

It could not be determined whether the extinguisher was charged prior to impact.

Recovered Dry Chemical Extinguisher Exhibit 1-7155

Recovered Dry Chemical Extinguisher Exhibit 1-7155 Examination

The top of the cylinder was punctured and a piece of plastic sheet was captured in the hole. The valve, trigger, carrying handle, flexible hose, nozzle, and locking pin were not recovered. The cylinder weighed 4.86 lb. The cylinder also exhibited impact marks.

(See photographs of "Recovered dry chemical extinguisher - Exhibit 1-7155" and "Recovered dry chemical extinguisher - Exhibit 1-7155 - impact marks aligned with bracket.")

Recovered Dry Chemical Extinguisher Exhibit 1-7155 Determination

Based on the position of the impact marks, it was determined that the marks resulted from contact with the mounting bracket attachment screws. This damage is consistent with the bottle being installed in the mounting bracket at the time of impact.

Recovered Dry Chemical Extinguisher Exhibit 1-7156

Recovered Dry Chemical Extinguisher Exhibit 1-7156 Examination

The cylinder was dented and the valve, hose, and nozzle were still attached. The trigger, carrying handle, pressure gauge, and locking pin were detached. The cylinder weighed 10.30 lb. According to a tag on the cylinder, it was last inspected on 11 May 1998. The Swissair control label exhibited the alphanumeric SN-NSN, 36201SV-SR. A piece of masking tape on the cylinder read Doghouse 9 RH. The valve body was displaced from an apparent side load and the top of the cylinder was partially collapsed on one side and bulged on the other. The corners of the valve head, adjacent to the locking pin, exhibited gouge marks. The valve was removed and there was no evidence of chemical agent or propellent discharge around the O-ring. The cylinder was full of the chemical agent up to the cylinder neck. The plastic fill tube was detached from the bottom of the valve. The bottle exhibited scoring in the area of the mounting bracket strap, but no mounting bracket damage could be identified. The discharge nozzle exhibited impact marks.

(See photographs of "Recovered dry chemical extinguisher - Exhibit 1-7156," "Exemplar dry chemical extinguisher - intact locking pin," "Exemplar dry chemical extinguisher - intact nozzle," and "Recovered dry chemical extinguisher - Exhibit 1-7156 - impact marks.")

Recovered Dry Chemical Extinguisher Exhibit 1-7156 Determination

The gouge marks on the corners of the valve are consistent with the pin being in place at the time of impact. Based on the noted damage, it was determined that the cylinder had not been discharged prior to impact. Since no damage to the mounting bracket could be identified, it could not be determined whether the bottle was installed in the mounting bracket at the time of impact. Based on the location of the impact marks on the discharge nozzle it was determined that the marks resulted from contact with the locking pin, indicating that the locking pin was installed at the time of impact.

Engine/Cargo/APU Fire Detection and Suppression Systems

General Description

The aircraft was equipped with six engine, one APU, and two cargo bay fire suppression agent bottles. The Engine 1 and Engine 3 systems were each fitted with two bottles in the corresponding wings. The Engine 2 system had two bottles located below Engine 2 in the aft accessory compartment. The Engine 2 bottles can also be used to extinguish a fire in the APU compartment. A third APU agent bottle was installed on the forward bulkhead of the APU compartment, as per SCN D2622E001, and operates automatically if a fire occurs in the APU compartment. Two bottles are installed in the center accessory compartment and supply chemical agent to the forward and center/aft lower cargo compartments.

The hermetically sealed, stainless steel firex bottles are filled with the chemical agent CF3BR. Each bottle is fitted with one or two discharge head assemblies that include debris screens, explosive cartridges, and flow channels. The agent bottles are manufactured by Walter Kidde Aerospace. The cartridges are electrically fired explosive squibs that supply the energy to rupture the frangible disk in the applicable bottle outlet. The frangible disc seal also functions as a pressure relief device.

The engine fire detection system is identical in all three engines. It supplies aural and visual fire warning alerts to the flight crew of possible fire conditions in the engine compartment. The engine fire detection system receives inputs from fire zones that become too hot as a result of fire or overheat conditions. The engine compartment detection system has two separate, gas-filled, fire detector loops suppling a single FDCU. The loops are divided into three parts. Each part has two fire detector assemblies attached in parallel to a stainless steel support tube assembly. The support tube assembly (with the two fire detector assemblies attached) is routed through specific fires zones in the engine. The two loops (loop A and loop B) transmit fire warning signals to the FDCU through the tripping of a pressure switch resulting from an increase in thermal pressure in the loop caused by a rise in temperature. The FDCU has two separate channels, one for each loop. Each loop detection system can receive fire warning signals with the other loop circuit open or grounded. A discriminator circuit in the FDCU identifies the signal from the loop as a system defect or a fire.

The engine fire zones generate the following warnings in the flight compartment:

  • Two red master warning lights on the glare shield
  • A 750 Hz warning bell
  • A red light on the applicable engine control handle (ENG 1 FIRE, ENG 2 FIRE, or ENG 3 FIRE, as applicable)
  • A red light on the applicable fuel ON/OFF switch
  • An applicable ENG FIRE level 3 alert on the EAD
  • An applicable ENG FIRE level 3 alert on the SD

Engine 2 Fire Detection System

Description

The Engine 2 firex handle and FUEL switch lights are powered by the 28 V DC battery bus through CB B1-644, located at position B-20 on the overhead CB panel.

The ground wire for Firex Handle Lights 2 runs from the light to the overhead switch panel, out of the right side of the panel to the overhead disconnect switch panel (behind the avionics CB panel), then down to the FDCU in the avionics compartment. As the wire leaves the overhead switch panel (in wire runs AMK and AMJ), the wire traverses an area of known heat damage and electrical arcing and high heat. A short to ground in any of the wires, however, would cause both the Firex Handle Lights 2 and the Engine 2 FUEL switch light to come on.

A ground in the Engine 2 FUEL switch light wire run would also turn both lights on. The ground wire for the Engine 2 FUEL switch light runs through several connectors from the light on the thrust control module to the centre pedestal, and then down into the avionics compartment to the FDCU.

Examination

A 15-inch section of the Engine 2 fire detection loop A power wire
B203-974-24 (Exhibit 1-1733, modified and renumbered exhibits 1-11147 and 1-12655) exhibited an area of once-molten copper.

CB B1-644 was not recovered; the CB next to it, however, CB B1-645 (Engine 3 firex handle and FUEL switch lights), located at position B-21 on the overhead CB panel, was recovered. There was no soot accumulation on the white CB indicator ring of CB B1-645.

No other wires in the wire run leaving the overhead switch panel were identified from this system.

Determination

The area of once-molten copper on the recovered 15-inch section of the Engine 2 fire detection loop A power wire B203-974-24 is typical of damage caused by an electrical arcing event. The wire was determined to be from a section of wire installed between pin *Z on connector P1-426 on the right overhead disconnect switch panel and pin 46JX on connector S3 613 in the overhead switch panel. This wire is part of the wire run that supplies 28 V DC Battery Bus power from CB B1-632 at location B-15 on the overhead CB panel to the FDCU, which is located on the forward equipment panel of the equipment rack in the avionics compartment. Because this wire is used to supply power to the FDCU (and not data from the loop detector to the FDCU, a short of this wire would not cause the FDCU to generate a fire warning signal. If the short had caused the circuit to open, loop A of the FDCU would be de-powered and only loop B would be active. With loop A de-powered, the FDCU would send a fault to the DEU, which would be displayed as "FIRE DET FAULT" level 1 alert. This level 1 alert would not likely result in flight crew action; the flight crew did not mention that this alert had occurred. If this fault occurred after the loss of DU 3, the flight crew would have been unaware of the alert. Because the FDCU and input wires to the FDCU are located in an area that did not exhibit heat damage, it was determined that an Engine 2 fire warning was not likely generated by false electrical inputs or shorts to the FDCU.

There was no soot accumulation on the white CB indicator ring of CB
B1-645 to indicate that the CB had tripped prior to impact. Based on its close proximity to CB B1-644, it was determined that a fire-induced thermal trip of CB B1-644 was unlikely.

Because the entire Engine 2 FUEL switch light wire run was located outside of the fire damaged area, it was determined that a short to ground in this run was unlikely.

Table: Engine/Cargo/APU Fire Bottle Determination

Bottle Position Bottle Recovered Disc Ruptured Cartridge Recovered Cartridge Fired Type of Discharge
Engine 1 position 101
(See photographs of "Engine 1 position 101 - Exhibit 1-7642" and "Engine 1 position 101 - Exhibit 1-7642 - close-up."
Yes No Yes No  
Engine 1 position 102
(See photographs of "Engine 1 position 102 - Exhibit 1-7643" and "Engine 1 position 102 - Exhibit 1-7643 - close-up."
Yes Cracked No Yes Low energy
Engine 2 position 201
Engine discharge port
APU discharge port
(See photograph of "Engine 2 position 201 - Exhibit 1-1306.")
Yes Cracked
Yes
Yes
Yes
Yes
Yes
Low energy
Over pressure
Engine 2 position 202
Engine discharge port
APU discharge port
(See photograph of "Engine 2 position 202 - Exhibit 1.")
Yes No
Yes
Yes
Yes
No
Yes
Normal
Engine 3 position 301
(See photograph of "Engine 3 position 301 - Exhibit 196.")
Yes Impacted No No  
Engine 3 position 302
(See photographs of "Engine 3 position 302 - Exhibit 1-7646" and "Engine 3 position 302 - Exhibit 1-7646 - close-up."
Yes Yes No Yes Normal
Cargo Compt Bottle 1
Fwd Compt discharge port
Aft Compt discharge port
(See photograph of "Cargo Compt Bottle 1 - Exhibit 1-1089.")
Yes Unknown
No
Yes
No
No
No
 
Cargo Compt Bottle 2
Fwd Compt discharge port
Aft Compt discharge port
(See photograph of "Cargo Compt Bottle 2 - Exhibit 1-7641.")
Yes Yes
Unknown
No
No
   
APU Fire Bottle No Unknown No    

Firex Bottle Explosive Cartridges Examination

Seven of the thirteen explosive cartridges were recovered from the engine, APU, and cargo firex systems. The hex flats on all of the recovered cartridges were stamped with PN OA876296. The “OA” prefix identifies the cartridges as PMA parts manufactured by Overland Aviation Services. The FAA Production Approval Listing for Parts Manufacturer Approval No. PQ3408CE, dated 5 October 1998 and applicable to Overland Aviation Services, did not list the MD-11 as an eligible model for installation of this cartridge.

The PN OA876296 explosive cartridges were identified in Overland Aviation Services manufacturer SB 22-09-97 (issued 19 September 1997) and SB 26-20-02 (issued 22 June 1998). The SBs stated that the OA876296 cartridges, lot numbered SB11-1 or OAS1-1, had been found to release excessive energy during functioning, which could result in damage to the associated discharge heads. Two of the recovered cartridges (the Engine 2/APU outlet Exhibit 1-1306 and one cartridge for which the position could not be identified) were stamped with lot number OAS 1-1. Both cartridges had discharged with sufficient energy to rupture the cartridge housing, indicating an over-explosive condition. The remaining recovered explosive cartridges were stamped with lot number OA97DB.

Two of the engine firex container frangible discs were cracked and dented in a manner that indicated that the applicable cartridge had discharged with insufficient energy to penetrate the disc properly (Engine 1 position 102 and Engine 2 position 201). The discharged cartridge that corresponded to one of the low-energy impacts was stamped with lot number OA97DB. The cartridge associated with the other low-energy impact was not recovered.

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

Flight Controls

  1. Primary Flight Controls
    1. Elevator Actuators Examination
    2. Aileron Actuators Examination
      1. Outboard Aileron Lockout
    3. Rudder Actuators Examination
  2. Secondary Flight Controls
    1. Flap/Slats System
      1. Description
      2. Examination
      3. Slat Disagree Alert
      4. Determination
    2. Spoiler System
      1. Examination and Determination
    3. Horizontal Stabilizer Trim System
      1. Description
      2. Examination
      3. Determination

Primary Flight Controls

Elevator Actuators Examination

All four elevator actuators (one per elevator segment) exhibited varying degrees of damage related to the impact and subsequent saltwater corrosion, with the right actuators exhibiting greater physical damage overall than the left actuators. Prior to disassembly, the as-recovered actuator rod extensions were measured. After disassembly, the actuators were examined for internal witness marks, which could indicate the position of the actuator at the time of impact. The measured elevator actuator piston (ram) extensions are contained in the following table:

Table: Measured Elevator Actuator Piston Extensions

Actuator Assembly Actuator Dimension (as received)[1] Actuator Dimension (internal markings) Comments
Left Inboard Elevator
SN 0068
16.270 in. or 15.2° TED[2] 2) 18.827 in. or 6.3° TEU
3) 16.617 in. or 2.4° TED
1) Two distinct piston positions were noted on the cylinder wall, as revealed by corrosion.
(See photographs "Left inboard elevator actuator" and "Left inboard elevator actuator - cylinder.")
Left Outboard
Elevator
SN 0248
14.879 in. or 0.3° TEU 15.052 in. or 2.0° TEU 1) Two parallel score marks were noted on the cylinder rod from contact with the forward bearing on the secondary cylinder.
(See photographs "Left outboard elevator actuator" and "Left outboard elevator actuator - cylinder rod.")
2) Piston score marks were noted on the internal wall of the secondary cylinder that align with score marks noted on cylinder rod.
(See photograph of "Left outboard elevator actuator - piston marks on cylinder.")
Right Inboard Elevator
SN 0015
18.310 in. or 1.6° TEU 18.490 in. or 3.2° TEU 1) Cylinder rod end bent with marks on cylinder rod from contact with forward bearing on secondary cylinder.
(See photographs "Right inboard elevator actuator" and "Right inboard elevator actuator - cylinder rod.")
2) Piston marks on the internal wall of both primary and secondary cylinders that align with score marks noted on cylinder rod.
(See photograph of "Right inboard elevator actuator - piston marks on cylinder.")
Right Outboard Elevator
SN 0031
14.280 in. or 5.3° TED 15.170 in. or 3.1° TEU 1) Two parallel score marks were noted on the cylinder rod from contact with the forward bearing on the secondary cylinder.
(See photographs "Right outboard elevator actuator" and "Left and right outboard elevator actuator - cylinder rods.")
2) Piston score marks were noted on the internal wall of the secondary cylinder that align with score marks noted on cylinder rod.
(See photograph of "Right outboard elevator actuator - piston marks on cylinder.")

No pre-existing faults were identified within any of the actuators or manifold assemblies.

Aileron Actuators Examination

All four aileron actuators (one per aileron) exhibited varying degrees of damage related to the impact and subsequent saltwater corrosion. Prior to disassembly, the as-recovered actuator rod extensions were measured. After disassembly, the actuators were examined for internal witness marks, which could indicate the position of the actuator at the time of impact. The measured aileron actuator piston (ram) extensions are contained in the following table:

Table: Measured Aileron Actuator Piston Extensions

Actuator Assembly Actuator Dimension
(as received)
Actuator Dimension (internal markings) Comments
Left Outboard Aileron
SN 0058
14.300 in. or 18.1° TED 12.775 in. or 1.9° TED 1) Piston score marks on forward and aft cylinders in captured position.
(See photographs "Left outboard aileron actuator" and "Left outboard aileron actuator - cylinder rods - captured position.")
2) Piston score marks on forward and aft cylinders in secondary position.
(See photograph of "Left outboard aileron actuator - cylinder rods - secondary position.")
Right Outboard Aileron
SN 0046
12.030 in. or 6.1° TED 12.958 in. or 3.8° TED 1) Piston score marks on forward and aft cylinders in captured position.
(See photographs "Right outboard aileron actuator" and "Right outboard aileron actuator - cylinder rods - captured position.")
2) Impact blow to forward cylinder, which perforated cylinder and damaged piston head seal groove in secondary position. Piston score marks on forward cylinder in secondary position.
(See photograph of "Right outboard aileron actuator - cylinder rods - secondary position.")
Left Inboard Aileron
SN unknown
19.150 in. or 12.5° TEU 20.630 in. or 0.2° TEU 1) Piston score marks on forward and aft cylinders in captured position.
(See photographs "Left inboard aileron actuator" and "Left inboard aileron actuator - cylinder rods - captured position.")
2) Parallel score marks were noted on the cylinder rod from contact with the forward bearing on the forward cylinder.
(See photograph of "Left inboard aileron actuator - cylinder rod score marks.")
Right Inboard Aileron
SN 747
19.246 in. or 11.7° TEU None 1) Piston score marks on forward and aft cylinders in captured position.
(See photographs "Right inboard aileron actuator" and "Right inboard aileron actuator - cylinder rods - captured position.")

No pre-existing faults were identified within any of the actuators or manifold assemblies.

Outboard Aileron Lockout

The outboard ailerons are low-speed ailerons and are automatically locked in the neutral position in high-speed configurations. With the extension of the slats or landing gear, or with a flap extension of 10 degrees or greater, the outboard ailerons become fully active. As the flaps were determined to have been extended to 15 degrees before impact, the outboard ailerons would have been fully active.

Rudder Actuators Examination

Both rudder actuators (one per rudder segment) exhibited varying degrees of damage related to the impact and subsequent saltwater corrosion, with the lower rudder actuator exhibiting the greater overall damage. Prior to disassembly, the as-recovered actuator rod extensions were measured. After disassembly, the actuators were examined for internal witness marks, which could indicate a position of the actuator at the time of impact. The measured rudder actuator piston (ram) extensions are contained in the following table:

Table: Measured Rudder Actuator Piston Extensions

Actuator Assembly Actuator Dimension
(as received)
Actuator Dimension (internal markings) Comments
Upper Rudder
SN 549
14.956 in. or 0.3° TEL[3] 15.311 in. or 2.8° TER 1) Two sets of piston marks were noted on the cylinder wall. One in the captured position, and one 0.355 in. in the extend direction.
(See photographs "Upper rudder actuator" and "Upper rudder actuator - cylinder rod - captured position.")
Lower Rudder
SN unknown
14.609 in. or 3.3° TEL 14.609 in. or 3.3° TEL 1) Cylinder rod bent with marks on cylinder rod from contact with forward bearing on cylinder.
(See photographs "Lower rudder actuator" and "Lower rudder actuator - cylinder rod - captured position.")
2) Piston marks on the internal wall of cylinder that align with marks noted on cylinder rod.

No pre-existing faults were identified with either actuator or manifold assemblies.

Secondary Flight Controls

Flap/Slats System

Description

Wing Flap System

There are two flap segments on each wing, one inboard and one outboard, each consisting of a flap and a vane. When the flaps are lowered, the vane increases the effectiveness of the flap system. Each flap segment is driven by two actuating cylinders, which are powered by two independent hydraulic systems.

Normal flap/slat operation is controlled by a single lever on the right side of the cockpit centre pedestal. The flap/slat control lever can be selected to five detent positions. (A 1.75 degrees "blue dot" detent is provided for rigging purposes only—the blue dot being a plug put in the detent position after rigging is accomplished.) The first detent position does not move the flaps, but extends all 16 (8 per side) leading edge slats. Normal slat extension is limited to speeds below 280 knots; it is generally selected to reduce speed during the initial landing approach or when the manoeuvring speed is less than approximately 250 knots. A take-off flap selector wheel provides a pre-selected detent for any flap setting between 10 degrees and 25 degrees. This second DIAL-A-FLAP setting is normally pre-selected to 15 degrees by the crew during their climb check procedures, and is used to slow the aircraft down, during initial approach, to the Vmin speed (for the current aircraft configuration) plus 20 knots. Depending on the weight and the C of G, this speed may be around 180 knots. The third detent position is the 28 degrees flap setting. This detent is generally used to slow the aircraft to an approach speed of the Vmin speed (for the current aircraft configuration) plus 5 knots (approximately 160 knots). The GEAR DOWN selection would normally be made after the selection of 28 degrees flap. The fourth detent position is the 35 degrees flap setting. This detent is normally used to slow the aircraft to the final FMS approach speed, to establish a stabilized approach before or upon reaching 1 000 feet agl. A switch provides a signal for the gear warning horn to activate if the flaps are in this position and the gear is not down. The fifth detent position is the 50 degrees full flap position. Normal landing flap is 35 degrees, while 50 degrees flap is used for high-performance landings.

Slats System

The MD-11 is equipped with eight slat segments on each wing—two inboard and six outboard of each engine—to provide lift augmentation at the lower speeds. The slats are electrically controlled and hydraulically actuated and have two positions: retracted or extended. Movement of the flap/slat control handle operates four switches in the flap/slat module, which provide signals to the inboard and outboard slat control valves for slat extension and retraction. The slat control valves, when activated, direct hydraulic pressure from hydraulic systems 1 and 3 to operate the two inboard and the four outboard hydraulic slat actuators. The slats are equipped with an overspeed protection system, which prevents the operation of the slats above 280 knots. The slat overspeed protection system is inhibited by a flap extension of 10 degrees or more. The slats are also equipped with an auto-extend system that extends the outboard slats at the onset of the stall warning system. If the stall is averted, the slats will automatically retract. In the event of a slat disagree alert or a loss of pressure from hydraulic systems 1 and 3, the slats are equipped with a SLAT STOW button. Operation of the SLAT STOW button enables the crew to lock the slats in the retracted position while operating the flaps.

The slat control valves receive their electrical power from the right emergency 28 V DC bus, through CB B1-30, at position E27 on the overhead CB panel (slat control power A); and the 28 V DC Bus 2, through CB B1-31, at position F2 on the lower avionics CB panel (slat control power B). The slat control valves will operate with one of the two power supplies inoperative.

Examination

Flap Actuators

All eight flap actuators exhibited varying degrees of damage related to the impact and subsequent saltwater corrosion. All of the actuator rod extensions were measured and three of the eight actuators were disassembled, cross-sectioned and examined for internal markings, which could indicate the position of the actuator at the time of impact. The resulting actuator extensions are contained in the following table:

Table: Resulting Actuator Extensions

Actuator Assembly Actuator Dimension (as received) Actuator Dimension (internal markings) Comments
Left Outboard Flap Outboard Actuator 25.9 in. or 12.0° FE[4]   (See photograph of "Flap actuator - left outboard flap - inboard and outboard actuators.")
Left Outboard Flap Inboard Actuator 30.9 in. or 35.0° FE   1) Actuator rod end failed in tensile overload, which may have moved the actuator upon impact.
(See photograph of "Flap actuator - left outboard flap - inboard and outboard actuators.")
Left Inboard Flap Outboard Actuator 34.3 in. or 38.0° FE See note[5] 1) Actuator rod moves freely within cylinder, captured position uncertain.
(See photographs 1 and 2 of "Flap actuator - left inboard flap - outboard actuator.")
Left Inboard Flap Inboard Actuator 27.8 in. or 11.0° FE 29.237 in. or 16.8° FE[6] 1) Piston scores marks on cylinders in captured position.
(See photographs 1 and 2 of "Flap actuator - left inboard flap - inboard actuator.")
2) Score mark on cylinder rod from contact with the forward gland nut on cylinder.[7]
(See photograph of "Flap actuator - left inboard flap - inboard actuator.")
Right Inboard Flap Inboard Actuator 28.3 in. or 13.0° FE   (See photograph of "Flap actuator - right inboard flap - inboard actuator.")
Right Inboard Flap Outboard Actuator 27.9 in. or 11.0° FE See note[8] (See photograph of "Flap actuator -right inboard flap - outboard Actuator.")
(See photograph of "Flap actuator - right inboard flap - outboard actuator.")
Right Outboard Flap Inboard Actuator 25.9 in. or 12.0° FE   (See photograph of "Flap actuator - right outboard flap - inboard and outboard actuators.")
Right Outboard Flap Outboard Actuator 26.3 in. or 13.0° FE  
Flap/Slat Control Handle

An examination of the flap/slat control handle arrangement revealed a distinct witness mark on the flap/slat detent track made by the flap/slat lever (or handle) being forced and bent approximately 60 degrees to the left upon impact.

(See photograph of "Flap handle.")

The position of the lever in relation to the impact markings placed the flap/slat control handle in the DIAL-A-FLAP range setting. The sector gear, which connects the take-off flap selector wheel to the DIAL-A-FLAP detent, consists of 17 gear teeth. Two of the teeth (the sixth and seventh from the lower flap limit), showed distinct gouging, caused when the sector gear and its pinion gear were forced together upon impact.

(See photograph of "DIAL-A-FLAP sector gear.")

Assuming that the pinion gear and sector gear were mated such that the use of all 17 teeth would represent the full range of movement between 10 degrees and 25 degrees, then the movement of one tooth would change the DIAL-A-FLAP setting by 0.88 degrees. If that were the case, then the damage at teeth 6 and 7 would represent a DIAL-A-FLAP setting of between 15 degrees and 16 degrees, which is the standard position pre-selected by the crew during their climb check.

Inboard Slat Control Valve

The inboard slat control valve was recovered and its position identified by a Swissair identification tag (IDN 473306, ASN 0013). The electric motor, used to linearly move the internal hydraulic valve assembly, was broken and missing. The manual select lever/indicator was in the slats-retract position. The lever/indicator was undamaged and displayed no signs of being driven into the slats-retract position. The valve body assembly contained seven of its eight inlet/outlet fittings and check valve assemblies.

(See photograph of "Inboard slat control valve.")

Outboard Slat Control Valve

The outboard slat control valve was recovered and its installed position identified by a Swissair identification tag (IDN 473306, ASN 0017). The electric motor was still attached; however, it was bent to one side, and three of the four mounting bolts had pulled free from the valve body. The manual select lever/indicator was captured in a position three quarters of the way toward the slats-extended position. The lever/indicator was undamaged; however, the position of the lever may have been influenced by the damage to the electric motor.

(See photograph of "Outboard slat control valve.")

Inboard Slat Actuators

One of the two inboard actuators was identified by the MD-11 IPC as PN 70739-1 (BRG0010-5519). The SN is unknown, as the actuator identification tag was missing. The actuator overall extension, from the centre of the body mounting holes to the centre of the actuator clevis hole, was 17.6 inches; the actuator chrome was extended 1.75 inches These extensions are consistent with the slat actuator having been in the fully retracted position. (The inboard actuators are retracted to retract the slats.)

(See photograph of "Inboard and right outboard slat actuators.")

The second inboard slat actuator was identified, by tag, as PN 70739-1 (BRG0010-5519), SN 50. The actuator was removed from a piece of the slat drive mechanism structure. The actuator overall extension, from the centre of the body mounting holes to the centre of the actuator clevis hole, was 17.6 inches; the actuator chrome was extended 1.75 inches These extensions are consistent with the slat actuator having been in the fully retracted position.

(See photograph of "Inboard slat actuator.")

Outboard Slat Actuators

One of the two left outboard actuators was identified by the MD-11 IPC as PN 1538200-1 (BRG0012-5505). The actuator tag was missing. Three outboard slat actuator tags (SN 0131, 0092, and 0097) were found loose among the wreckage, but could not be matched with their respective actuators. The actuator cylinder was fully extended and bent at the end of the actuator body. The actuator overall extension, from the centre of the body mounting holes to the centre of the actuator clevis hole, was 24.4 inches; the actuator chrome was extended 7 inches The outboard slat actuators move in an opposite direction to the inboard slat actuators in that they are extended to retract the slats. The actuator was determined to be in the fully extended, or slats-retracted, position.

(See photograph of "Left and right outboard slat actuators.")

The second left outboard actuator was identified by the MD-11 IPC as PN 1538200-1 (BRG0012-5505). The actuator tag was missing. The actuator cylinder was bent at the actuator housing and had broken off. The internal measurement of the remaining actuator cylinder was 4 inches to the actuator housing seal, which is consistent with a fully extended cylinder. The actuator cylinder was recovered and the chrome measured at 7 inches to the bend in the actuator. The actuator was determined to have been in the fully extended, or slats retracted, position.

(See photograph of "Left and right outboard slat actuators.")

One of the two right outboard actuators was identified by the MD-11 IPC as PN 1538200-1 (BRG0012-5505). The actuator tag was missing. The actuator cylinder was broken off at the end of the actuator housing. The internal measurement of the remaining actuator cylinder was 4 inches to the actuator housing seal, which is consistent with a fully extended cylinder. The actuator was determined to have been in the fully extended, or slats retracted, position.

(See photograph of "Inboard and right outboard slat actuators.")

The other right outboard actuator was identified by the MD-11 IPC as PN 1538200-1 (BRG0012-5505). The actuator tag was missing. The actuator cylinder was broken off at the end of the actuator housing. The internal measurement of the remaining actuator cylinder was 4 inches to the actuator housing seal, which is consistent with a fully extended cylinder. The actuator was determined to have been in the fully extended, or slats retracted, position.

(See photograph of "Inboard and right outboard slat actuators.")

Slat Tracks

The slat tracks were recovered and examined. Of interest was a series of markings noted on the upper roller surface on several of the slat tracks. The marks or scratches were made from contact with the upper rear roller bearing as it failed on impact. The direction of the scratches indicated that the failure of the rear bearing occurred while the slats were in the retracted position and progressed forward as the slats were torn from the wing.

Slat Disagree Alert

A slats disagree alert is a recorded FDR parameter. This parameter was not recorded prior to the loss of the FDR. The FDR recorded that the four slats L2/L4 and R2/R4 went from retract to transit. Between 0125:06 and 0125:14 (while the DFDAU was outputting frozen DEU-1 data) the PSEU B sensors changed from "target near" to "target far." This resulted in the DEU output to the DFDAU changing from "retract" to "transit." At 0125:15, the transit state was recorded from DEU-3. This change of state has two possible causes. Either the slats are actually transitioning, or there is a loss of power to the B sensors. Investigation concluded that the slats were not moving. The airspeed of 320 knots exceeded the slat overspeed protection threshold of 284 knots, which inhibits slat extension. The crew never discussed deploying the slats and there was no sound signature heard on the CVR that would normally be associated with the slat/flap lever or slats deploying. Furthermore, the slats were found to have been retracted at the time of impact. Therefore, it was concluded that B sensor power was lost.

Power for the B sensors is provided by the 28 V DC Bus 1 through CB "Slat Pos Sys 2" on the upper avionics CB panel at position E-09. The loss of power to the "Slat Pos Sys 2" CB would not have any effect on the cockpit displays. At the time the recorders lost power, it is possible that DUs 1, 3, 4, 5, and 6 were blank. If there was an actual slats disagree event after the flight recorders stopped at 0125:41, then the crew may not have seen the alert and would not have pushed the SLAT STOW button.

Determination

An examination of the flap/slat control handle and the eight flap actuators indicated that the flaps had been lowered prior to impact, probably to the 15 degrees detent. This position is consistent with the DIAL-A-FLAP wheel being pre-selected by the crew during their climb check procedures.

The slats are normally extended automatically with flap extension; however, all six slat actuators were captured in the retracted position at the time of impact. Because the flaps were found extended beyond the 10 degrees position, the slat overspeed protection system would have been inhibited and would not have prevented the slats from extending. The slat extend function can be overridden by the use of a SLAT STOW button, but it is unlikely that this was used. The SLAT STOW button would normally be used only with a slat disagree alert, or after the loss of hydraulic systems 1 and 3. If a slat disagree event occurred, it is unlikely that the crew would have been aware of it. A loss of hydraulic systems 1 and 3 is unlikely, as engines 1 and 3 were running at the time of impact.

As the slat control valve CBs (on the overhead and lower avionics CB panels) are near the known fire damage and electrical arcing events, it is likely that the failure of the slats to extend was a result either of a loss of (or interruption in) the electrical wiring to the slat control valves, or a tripping of the control CBs caused by heat from the fire.

Spoiler System

Examination and Determination

Spoiler Actuators

All 10 spoiler actuators (5 per wing) exhibited varying degrees of damage related to the impact and subsequent saltwater corrosion. Prior to disassembly, the as-recovered actuator rod extensions were measured. After disassembly, the actuators were examined for internal witness marks, which could indicate a position of the actuator at the time of impact. The measured spoiler actuator piston (ram) extensions are contained in the following table:

Table: Measured Spoiler Actuator Piston Extensions

Actuator Assembly Spoiler Actuator Dimension (as received)[9] Actuator Dimension (internal markings) Comments
Left No. 5, SN 5220 9.1015 in. (retracted) None 1) Input lever damaged
(See photograph of "Left spoiler actuators.")
Left No. 4, SN 5211 9.1025 in. (retracted) None  
Left No. 3, SN 1340 9.0985 in. (retracted) None  
Left No. 2, SN 5217 9.1920 in. 1.6° up[10] None 1) Rod end damaged; bearing pushed out.
Left No. 1, SN 5291 9.270 in. 3.0° up None 1) Input lever slightly damaged/bent.
Right No. 1, SN 5198 9.124 in. 0.3° up None 1) Rod end and bearing damaged.
(See photograph of "Right spoiler actuators.")
Right No. 2, SN 5230 9.1110 in. (retracted) None  
Right No. 3, SN 5231 9.490 in. 7.0° up None  
Right No. 4, SN 5234 9.1670 in. 1.1° up None  
Right No. 5, SN 5218 9.1135 in. 0.1° up None 1) Input linkage missing.

No pre-existing faults were identified within any of the actuators or manifold assemblies.

Spoiler Handle Track

The spoiler handle track is mounted in the cockpit centre pedestal to the left of the throttle quadrant. The track has four detent positions: RETRACT, 1/3, 2/3, and FULL (speed brake positions). The single-lever spoiler handle is equipped with a sliding bar arrangement that engages with the applicable slot in the spoiler track, depending on the setting desired. During examination of the spoiler handle track, an indentation was found on the rear face of the RETRACT slot position, indicating that the spoiler handle was most likely in that position at the time of impact.

(See photographs of "Spoiler handle track" and "Spoiler handle track indentation.")

Horizontal Stabilizer Trim System

Description

The MD-11 is equipped with an adjustable horizontal stabilizer to provide longitudinal trim of the aircraft. The stabilizer is moved by two jack screw actuators, which are connected to a common gearbox through drive chains. The gearbox is operated by two independent, two-speed hydraulic trim motors, which are powered by aircraft hydraulic systems 1 and 3. The hydraulic stabilizer control valves direct hydraulic fluid to the hydraulic trim motors, which turn the stabilizer gearbox and then operate the actuators via chains. Backup hydraulic power to the hydraulic motors is provided by Hydraulic System 2, through the 2-1 non-reversible motor pump. The horizontal stabilizer can be controlled in the following four modes of operation:

Automatic Pitch Trim via Autopilot

When the autopilot is engaged, the stabilizer position is automatically controlled by the FCC to off load steady-state elevator commands greater than 1.3 degrees.

Automatic Pitch Trim via LSAS

During manual flight operations, the LSAS will command the elevators to maintain the airplane's pitch attitude and, if required, will gradually off load the elevator input by moving the horizontal stabilizer through an automatic pitch trim function. This LSAS automatic pitch trim function is inhibited if any of the following conditions apply: the aircraft bank angle exceeds 5 degrees; the pitch force applied to the control column exceeds 2 lb; or the crew is manually trimming the stabilizer with either the control wheel trim switches or the longitudinal trim handles. The LSAS system has four independent channels, which operate through the two FCCs. The LSAS automatic trim function will remain operative as long as one FCC channel is available.

Manual, Electrically Commanded Pitch Trim via Control Wheel Trim Switches

Manual, electrically commanded actuation of both horizontal stabilizer trim motors is available through use of the electric trim switches located on both crew control wheels, and will move the stabilizer in the commanded direction. Electrical power for the trim switches is supplied by the 28 V DC Bus 2 through CB B1-507, located at position F3 on the lower avionics CB panel.

Manual, Mechanically Commanded Pitch Trim via Longitudinal Trim ("Suitcase") Handles

Manual, mechanically commanded pitch trim, through the use of the longitudinal trim handles (which resemble suitcase handles), is provided by cables and pulleys to the hydraulic stabilizer control. This method is entirely mechanical and does not require any electrical power. The manual input to the hydraulic control valves overrides electrical inputs to the valve.

Horizontal Stabilizer Jack Screw Rigging Dimensions

The MD-11 horizontal stabilizer rigging instructions are contained in the MD-11 Maintenance Manual, Section 27-40-00-5. The rigging is controlled by adjusting the stabilizer jack screw actuators and indicating system to a neutral position and then ensuring that the actuators meet their full travel-range dimension checks. The actuator dimension is determined by taking a measurement of the actuator length between the actuator's upper and lower stop surfaces.

The rigging dimensions as shown in the MD-11 Maintenance Manual,
Section 27-40-00-5, are as follows:

Table: Rigging Dimensions

Aircraft Nose Up Configuration page, 15.5° to 17.0° ANU 0.61 to 1.51 in. Actuator extension
Neutral Configuration page, 0° ± 1.0° 30.68 to 30.83 in. Actuator extension
Aircraft Nose Down Configuration page, 0.9° to 2.2° AND 33.17 to 34.06 in. Actuator extension

Examination

Horizontal Stabilizer Jack Screw

The left horizontal stabilizer jack screw actuator was recovered as a single unit. The actuator was identified through the MD-11 IPC as PN AJH 7349-503. The upper clevis end was broken away and found attached, in place, to a piece of the horizontal stabilizer box structure. The actuator screw nut and portions of the drum assembly and attachment structure were still attached to the actuator. The actuator upper and lower stop collars were intact and did not show signs of contact. The actuator and clevis end were mated and the actuator extension was measured at 30.69 inches, or just within the minimum neutral extension limit. The screw nut was free to rotate.

(See photograph of " Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003

Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

Flight Management System

  1. Flight Management System Description
  2. Situational Awareness of Airports
    1. Closest Airports
    2. Navigation Display
  3. Diverting from the Flight Plan
    1. FMS NAV Mode
    2. Heading/Track Mode
    3. Inserting a New Destination
  4. Obtaining Information for the Halifax International Airport
    1. Reference Page
    2. TAKE-OFF/APPROACH Page
  5. Back-Course Approach
  6. Programming the FMS for an Approach into Halifax Airport

Flight Management System Description

The FMS is used by pilots for flight planning, navigation, performance management, aircraft guidance, and flight progress monitoring. Pilots use the FCP to select flight modes and the MCDU to enter flight plans and other flight data. The FMCs use the flight data to generate a flight profile from the origin to the destination airport. The FMCs then guide the aircraft along that profile by providing moding requests, speed targets, and altitude targets to the FCCs. Roll commands provide lateral control. Pitch commands are only provided during descent when the aircraft is on path. The FMC navigation database includes most of the information the pilot would normally obtain by referring to navigation charts. This information can be displayed on the MCDU or the EIS map.

(See illustration of "MCDU display - active flight plan.")

Situational Awareness of Airports

The SR 111 flight crew had several options available to help them determine their position relative to a diversion airport.

Closest Airports

Pushing the REF mode key on the MCDU selects the REF INDEX page from which several reference pages can be accessed.

(See illustration of "MCDU display - reference index.")

Upon selection of the left line select key adjacent to the CLOSEST AIRPORTS option, the closest airports in order of distance from the aircraft are displayed on the MCDU. The flight crew may enter airport identifiers in the fifth line position to display the bearing and distance to that airport.

(See illustration of "MCDU display - closest airports.")

Navigation Display

The NDs are located on the captain's and first officer's instrument panel. The ND displays aircraft position, way points, navigational aids, airports, weather, ground speed, true airspeed, wind speed and direction, time, and flight plan. The EIS control panel operates the captain's and first officer's ND. It is located on both outboard ends of the glare shield. When the ARPT button is pushed, all airports stored in the FMS database appear on the ND within displayable ranges. Likewise, when the VORNDB button is pushed, all VORs or NDBs are displayed; the bearing pointers (and DME distances) are also displayed depending on the selection of the VOR and ADF switches.

(See illustrations of "EIS control panel" and "Navigation display.")

Diverting from the Flight Plan

In order to divert from their present position directly to another position (i.e., to either the FMS stored flight plan or to a new waypoint or airport), the flight crew could use one of the following methods:

  1. Use the FMS NAV mode; or
  2. Use the HDG or TRK mode.

FMS NAV Mode

When the DIR/INTC key on the MCDU is pushed, a page similar to the active flight plan is displayed.

(See illustration of "MCDU display - divert flight plan.")

The flight crew manually enters the new waypoint or airport (e.g., KBOS, CYHZ) beside the left line select key. The flight crew may also enter a course of intercept beside the first right line select key. Subsequent selection of either the waypoint or intercept will cause the aircraft to fly directly to that point.

If the new point is not in the original flight plan, the MCDU displays the message "F-PLAN DISCONTINUITY."

(See illustration of "MCDU display - flight plan discontinuity.")

To clear the discontinuity, the flight crew selects the CLR key on the MCDU scratchpad and presses the line select key beside the F-PLAN DISCONTINUITY message on the MCDU. After reaching the new waypoint, the aircraft flies to the next point on the original flight plan. The DIR TO option, therefore, is only used to fly to any desired point.

Heading/Track Mode

The HDG or TRK mode is selected by pushing the HDG/TRK button on the FCP. To engage the mode, the flight crew either pushes or pulls the heading knob. The flight crew can have the autopilot fly a selected heading or track to the waypoint or airport.

(See illustration of "Flight control panel.")

In the TRK or HDG mode, a dashed line appears on the ND from the aircraft's position to the edge of the ND range. This line indicates that the flight crew may select a direct track on which the aircraft can fly to an airport or NAVAID as displayed on the ND.

Inserting a New Destination

To insert a new destination into the flight plan, the flight crew selects the left line select key beside the last waypoint overflown (BRADD) on the MCDU. The LAT REV page appears.

(See illustration of "MCDU display - LAT REV page.")

The flight crew enters the airport identifier for the Halifax International Airport, CYHZ, and then selects the right line select key beside the NEW DEST prompt; this returns the MCDU to the original F-PLN page, which displays a discontinuity after the lateral revise point, followed by the new destination, CYHZ.

Obtaining Information for the Halifax International Airport

There are two methods of obtaining runway information on the Halifax International Airport from the MCDU:

  1. Select the reference page; or
  2. Select the TAKE-OFF/APPROACH page.

Reference Page

To display the reference page, the flight crew selects the REF mode key and then selects the WAYPOINT option.

(See illustration of "MCDU display - reference index.")

The waypoint reference page appears blank, except for the title. The flight crew enters CYHZ06 beside the first left line select key. The information for Runway 06 appears.

(See illustration of "MCDU display - WAYPOINT page.")

TAKE-OFF/APPROACH Page

The flight crew selects the TO/APPR mode key once the new destination is inserted into the flight plan.

(See illustration of "MCDU display - TAKE-OFF/APPROACH page.")

Back-Course Approach

Although the FMS equipment on Swissair's MD-11 does not display nor allow selection of back-course information, Swissair uses a standard operating procedure to conduct non-FMS back-course approaches. The flight crew enters the information into the MCDU by selecting the NAV/RAD mode key. The flight crew manually enters the approach frequency and the appropriate front beam inbound course beside the fourth left line select key (the ILS.CRS field). The aircraft then flies on ATC vectors for the final approach using the HDG mode. When established on the inbound course, the flight crew switches to the TRK mode.

(See illustrations of "Flight control panel" and "MCDU display - NAV RAD mode.")

Programming the FMS for an Approach into Halifax Airport

When the flight crew selects the F-PLN mode key, the active flight plan appears. When the left line select key beside CYHZ is selected, the LATERAL REVISION page appears.

(See illustration of "MCDU display - LAT REV page.")

The flight crew then selects the right line select key beside STAR. A list of FMS-stored instrument approaches to the Halifax International Airport appears on the right side of the page and available STARs appear on the left side of the page.

(See illustration of "MCDU display - STAR to CYHZ page.")

The flight crew then selects the desired approach. Since there is no back-course approach in the FMS database, the NDB for Runway 06 can be selected.

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

Fuel Dumping

  1. Fuel Dump Description
    1. Fuel Dump Valves
      1. Description
      2. Examination
      3. Determination
    2. Fuel Dump Electrical Power Supply
      1. Description
      2. Examination
      3. Determination
    3. Flight Data Recorder and ATC Information on Fuel Dump
      1. Description
      2. Examination
      3. Determination
    4. Fuel Dump Rate
      1. Description
      2. Determination
  2. Fuel Dump Determination
    1. Crew Initiated Fuel Dump – Closing of Auxiliary Tank Fill Isolation Valve
    2. Loss of Electrical Power to the Valve after Fuel Dump Initiated
    3. Fuel Pump Operation with Respect to Fuel Dumping

Fuel Dump Description

Fuel Dump Valves

Description

On the MD-11, two fuel dump valves are located in the left and right trailing edge of each wing, between the flap and outboard aileron. The dump valves are electric motor-driven, gate shut-off valves with an external red handle for manual override capability (for maintenance action only). The fuel dump valve is manufactured by ITT Aerospace Controls Division as PN AV16B1926C. In the event of a loss of electrical power, the valve remains at the last commanded position.

Examination

Left Wing

A three-foot-by-four-foot section of left-hand wing structure that contained the fuel dump valve and mast assembly was recovered. The section of structure was bordered by the outboard flap track and a portion of the integral fuel cell wall surrounding the fuel dump outlet. The fuel dump valve body assembly had broken off and had been recovered separately. The electric motor and valve actuator were attached to the structure by the lockwire on the electrical receptacle.

(See photograph of "Left wing fuel dump valve actuator attached to wing structure.")

The actuator was recovered with the actuator handle in the CLOSED position. The tip of the handle exhibited a small gouge with a build up of material corresponding to a force that would have biased the handle toward the CLOSED position. The handle had a smaller impact mark on the other side, which would have biased the handle toward the OPEN position. An attempt was made to move the handle and slight pressure was applied. The handle was jammed and did not move.

(See photograph of "Left wing fuel dump valve as recovered.")

The valve portion of the actuator was recovered separately and was relatively intact. A tag on the valve identified the unit as ITT Aerospace Controls, PN AV16B1926C, SN N 42914. The valve was recovered in the OPEN position, which contradicted the CLOSED position of the actuator. The slide housing cap was removed and water was drained from the housing. Two of the cap screws that held the housing cap in place were impacted, which bent one of the screws and left a small indentation in the housing. The fuel pipe flanges were removed and the "O" ring on the pressure side of the valve had been forced outwards in three locations.

(See photograph of "'O' ring forced outward.")

The dump valve was disassembled and the output shaft was found bent.

(See photograph of "Disassembled valve.")

It appears that the slide gate had been driven upward beyond its normal OPEN position, thereby contacting and bending the output shaft.

(See photograph of "Bent output shaft.")

One of the slide guides was displaced from its normal position to a position where the end of the supports was extending beyond the end the housing. The slide gate had a circumferential impact mark around the face of the slide from contact with the slide housing.

(See photograph of "Slide gate circumferential impact mark.")

Right Wing

The right wing fuel dump mounting structure, Exhibit 1-5703, was similar to the left wing fuel dump mounting structure, Exhibit 1-3107, in both size and shape.

(See photograph of "Right wing fuel dump valve.")

A tag on the fuel dump valve identified it as ITT Aerospace Controls, PN AV16B1926C, SN N 42915A. The fuel dump valve assembly was bent out of position and the upper half of the electrically driven valve actuator had broken off at the electrical receptacle and was not recovered. The valve actuator output shaft was coupled to the fuel dump valve body. The valve body was intact and the slide gate was in a near-closed (90 per cent) position.

(See photograph of "Slide gate in near-closed position.")

The slide housing cap was removed and jet fuel was drained from the housing. The external red handle was bent back across the housing on the attached half of the valve actuator. The tip of the handle was broken off. The handle was captured in an intermediate position biased toward the CLOSED position, but was not aligned with the position of the slide gate.

(See photograph of "Handle in the intermediate position
biased toward CLOSED
.")

The pin securing the handle to the output shaft was sheared from a blow to the handle. The direction of driving force on the handle was from the CLOSED to the OPEN position.

The fuel pipe flanges were removed and the "O" ring seals were in place. The valve was disassembled and no abnormal markings were noted on the internal components

(See photograph of "Disassembled valve.")

Determination

Left Wing

The ruptured flange "O" ring on the pressure side of the fuel dump valve is consistent with fuel in the pipe being forced against a closed slide gate at the time of impact. Such damage to the flange "O" ring would not be expected with the slide gate in the OPEN position.

Based on a stress analysis of the bent output shaft, it was determined that it would have taken approximately 260 lb of force to bend the shaft, well beyond loads expected during normal operation.

The circumferential impact mark around the face of the slide from contact with the slide housing is consistent with the slide being in the CLOSED position.

Based on the damage to the "O" ring, combined with the circumferential mark on the slide gate, the bent output shaft, and the position of the actuator lever, it was determined that the fuel dump valve was in the CLOSED position at the time of impact and had been driven open by impact forces.

Right Wing

There was no damage to the valve indicating that the valve was in a position other than the CLOSED position at the time of impact. The damage to the actuator handle is consistent with the valve being driven partially open by a blow to the handle. The lack of damage to the flange "O" ring seals, particularly on the pressure side of the valve, is inconsistent with the damage observed on the left fuel dump valve; however, this inconsistency may be related to the impact angle and impact forces.

Fuel Dump Electrical Power Supply

Description

The DUMP switch controls the fuel dump operation through the left and right fuel dump valve control relays. The fuel dump valves require power from their respective fuel dump valve control CBs to either open or close. The power for the left fuel dump valve comes from the 28 V DC Bus 1 through CB B1-458 located at position H-22 on the upper main CB panel.The power for the right fuel dump valve comes from the 28 V DC Bus 3 through CB B1-457 located at position K-22 on the upper main CB panel. The power input and output wires to the DUMP switch are routed behind the avionics CB panel and pass through the right-side oval opening in the overhead switch panel housing.

The FSC monitors, but does not control, fuel dump operations. The FSC is located below the cockpit floor on the main avionics rack in the avionics bay. The FSC is equipped with a dual power source. Channel A power is supplied by the 28 V DC Bus 1 through CB B1-1582 located at position H-26 on the upper main CB panel. The circuitry for Channel A does not traverse any known area of fire damage. Channel B power is supplied by the right emergency 115 V AC bus through CB B1-1583 located at position G-23 on the overhead CB panel. Power from the CB is provided via wire B201-325-20 on wire runs AMP, AMK, and AMH to P1-238 located behind the upper avionics CB panel. This wire is routed through an area of known fire damage. From that area it proceeds down the right side of the aircraft via wire B203-911-20 on wire run AAC to the main avionics rack.

Examination

The power input and output wires from the DUMP switch were not identified. However, the wires extending from connectors P1-420 and P1-421 on the overhead disconnect panel to the right-side oval opening in the overhead switch panel housing progressed through a known area of high heat.

Determination

Based on known fire damaged areas, the only wires or CBs in the fuel dump system that might have been affected by fire or heat were the wire and the CB supplying power to the FSC Channel B and the power input and output wires from the DUMP switch that were routed in the area of the overhead disconnect panel. The loss of power to the FSC Channel B would not affect fuel dump operations as the FSC only provides a monitoring function. However, the opening or shorting of the input or output wires from the DUMP switch would result in the loss of control of one or both fuel dump valves as they would stay in their last commanded position.

Flight Data Recorder and ATC Information on
Fuel Dump

Description

The DFDR records Aircraft Gross Weight and Total Fuel quantity. The last Aircraft Gross Weight value was recorded at 0124:56. At 0124:53, the crew indicated to ATC that they were starting to dump fuel. Four seconds later at 0124:57, ATC informed SR 111 that they would contact them in just a couple of miles; SR 111 acknowledged the transmission and indicated that they were declaring an emergency. At 0125:16, ATC cleared SR 111 to commence the fuel dump; this transmission was not recorded on the CVR. SR 111 did not respond and no further communications were received from the aircraft.

Examination

The DFDR information was examined to determine whether the crew may have started the fuel dump prior to notifying ATC about their intentions to dump fuel. The aircraft C of G was plotted against its gross weight (see chart of "Centre of Gravity (C of G) data plot"); an increase in the slope of the plot (a faster drop in Gross Weight) was apparent for the last two data points. The data was subsequently compared with aircraft operational data.

Determination

Based on the data comparison, it was determined that the faster drop in Aircraft Gross Weight was likely the result of the aircraft levelling off at 10 000 feet and the engines coming up above idle thrust. The increased fuel flow to the engines would result in a corresponding drop in fuel quantity and gross weight. Had the fuel dump been initiated, the slope of the plot would dramatically increase.

Because Aircraft Gross Weight DFDR information was recorded after the crew indicated to ATC that they were starting to dump fuel, it could not be established from DFDR information whether the crew had initiated a fuel dump at that time. An analysis of the aircraft C of G versus gross weight plot indicated that fuel dumping had not been initiated prior to the loss of the DFDR data.

Fuel Dump Rate

Description

At the time that the DFDR was lost, the aircraft weighed approximately 230 metric tonnes. At a maximum dump rate of 2 600 kg/min (2.6 metric tonnes/min), it would have taken a minimum of 11.7 minutes to dump the 30 metric tonnes of fuel needed to reach the aircraft's maximum landing weight of 199.58 metric tonnes (as preselected on the aircraft's FMS), and about 4.5 minutes to reach the maximum overweight landing weight of 218.4 metric tonnes. The aircraft crashed 5 minutes, 41 seconds, after the loss of the DFDR. If the fuel dump had commenced, the main tank fuel levels were such that the fuel dump would not have been terminated automatically by reaching the tank low level condition.

It is not known whether the crew selected the FUEL INIT Page on the MCDU to change the auto dump level as programmed into the FMS; this page is not recorded on the DFDR.

Determination

If fuel dumping had been initiated by the crew after the loss of the DFDR, there would not have been sufficient time to dump the fuel required to reach the maximum landing weight as preselected in the FMS. Without information indicating that the crew had reselected the auto dump level in the FMS, fuel dump operation should have been ongoing at the time of impact. A loss of electrical power will not close the fuel dump valves. To terminate fuel dump prior to reaching the auto dump level, if fuel dump had been initiated, crew action would have been required.

Fuel Dump Determination

There was no evidence indicating that fuel was being dumped prior to the loss of the DFDR. If a fuel dump was initiated after the loss of the DFDR, it would have taken a minimum of 11.7 minutes for the FSC to automatically stop the fuel dump once landing weight was achieved. The fact that the fuel dump valves were closed at the time of impact indicates that either the fuel dump was initiated after the loss of the DFDR and then manually terminated before impact, or that the fuel dump was not initiated. Because the valves must be electrically opened or closed, a loss of electrical power to the valves after the dump has been initiated will cause the valves to remain open. If the SMOKE ELEC/AIR selector was used prior to or during the fuel dump, the switch would have to have been rotated through to the 2/3 OFF or the NORM position prior to impact in order to close both valves. Based on an examination of the known fire damaged wiring, it could not be determined whether the fuel dump valves were operational at the time of impact. The CLOSED position of the auxiliary tank fill/isolation valve could indicate that fuel dumping had taken place. Based on the analysis of the fuel pumps, it was determined that the Tank 2 right aft boost pump was off, which is consistent with the CLOSED position of the fuel dump valves, as fuel dumping takes precedence over an engine shutdown.

Crew Initiated Fuel Dump – Closing of Auxiliary Tank
Fill Isolation Valve

If fuel dumping was initiated after the loss of the recorders, the FSC would close the auxiliary tank fill isolation valve (opened for tail fuel forward transfer), redirecting tail tank fuel to the upper auxiliary tank. As there would not be any fuel in the auxiliary tank at this time, fuel would be dumped overboard from the main fuel tanks only, at a rate of approximately 5 200 lb/min, supplied by the 10 main tank fuel pumps. The auxiliary fuel tank would then start to be filled from the tail tank and when the tank quantity reached more than 2 100 lb, the FSC would turn on the two upper auxiliary tank pumps to increase the fuel dump rate to 6 000 lb/min. Given the amount of fuel on board, fuel dumping would take almost 12 minutes to bring the quantity down to the aircraft's maximum landing weight. As the aircraft crashed 5 minutes, 41 seconds after the loss of the recorders there would not have been time for the fuel dump to have been automatically terminated by reaching the pre-programmed dump setting or the tank low-level condition. However, the fact that the fuel dump valves were found in the CLOSED position indicates that if the crew initiated a fuel dump they terminated it before the time of impact.

When a fuel dump is terminated the FSC determines which mode to go into next. If a fuel dump was initiated during tail tank fuel transfer forward and lasted for more than three minutes, the upper auxiliary tank would most likely contain more than 2 100 lb of fuel and the FSC would enter into a reschedule mode. In this mode, the FSC does not re-open the auxiliary tank fill isolation valve and continues to transfer fuel to the upper auxiliary tank as long as the quantity in the tank stays above 1 800 lb. The tail tank fuel flow rate into the upper auxiliary tank is about the same as the transfer of fuel out of the tank; therefore, the reschedule mode would continue until the tail tank is empty. As there was insufficient time prior to the time of impact to empty the tail tank, the auxiliary tank fill isolation valve would remain closed.

Loss of Electrical Power to the Valve
after Fuel Dump Initiated

If a fuel dump was initiated, closing the auxiliary tank fill isolation valve, the fire could have compromised the wiring or CBs resulting in the auxiliary tank fill/isolation valve remaining closed.

Fuel Pump Operation with Respect to Fuel Dumping

Based on the FADEC fault data, it was determined that Engine 2 was shut down using the FUEL switch. Using this switch would shut off the Tank 2 fuel boost pumps. As fuel dumping takes precedence over an engine shut down, the fuel pumps in the tank corresponding to the shut-down engine would not be shut off. The Tank 2 right aft boost pump being off is consistent with Engine 2 shut down and the fuel dump valves being in the CLOSED position. The Tank 2 transfer pump exhibited sufficient rotational damage to determine that it was running at the time of impact. This pump would come on with Engine 2 shut down if there were a fuel imbalance between tanks 1 and 3, and Tank 2, as would be expected with the upper auxiliary tank supplying fuel to Tank 2.

Based on the available physical evidence and CVR data, it was determined that the crew initiated a fuel dump between the time the recorders and ATC communications were lost and the time of impact. The fuel dump was terminated by the crew prior to impact.

Either the fuel dump was occurring for at least three to four minutes to allow sufficient fuel to enter the upper auxiliary tank to reschedule the fuel system to keep the auxiliary tank fill isolation valve closed or the fire tripped both auxiliary tank fill isolation CBs after the fuel dump was initiated. If the first scenario is correct, the fuel dump was terminated one to two minutes prior to the time of impact or at approximately the same time as Engine 2 was shut down.

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

Fuel System

  1. Fuel System
    1. Examination
      1. Auxiliary Tank Fill/Isolation Valve
      2. Tail Tank Fill/Isolation Valve
      3. Fuel Crossfeed Valves
      4. Fuel Pump
  2. Fuel Pump Operation
    1. Determination
      1. Tank 1
      2. Tank 2
      3. Tank 3
      4. Upper Auxiliary Tank
      5. Lower Auxiliary Tank
      6. Tail Tank
      7. Summary
  3. Fuel Management
    1. Examination
      1. Fuel Schedule Conditions
    2. Determination
      1. Fuel Schedule Management
      2. Auxiliary Tank Fill/Isolation Valve

Fuel System

Examination

Auxiliary Tank Fill/Isolation Valve

The valve consists of two parts: the valve body, which is inside the upper auxiliary tank, and the motor actuator assembly, which can be replaced externally. The valve, heavily damaged, was recovered in several pieces. A "T" section of the fuel piping was still attached to the valve body and was used to identify the valve as being part of the auxiliary tank fill/isolation valve. The valve slide was retained within the housing and was captured in the CLOSED position.

(See photographs "Auxiliary tank fill/isolation valve housing" and "Auxiliary tank fill/isolation valve - valve slide.")

The electrical valve motor actuator assembly and related portion of the slide housing were broken off the valve, but were recovered in a section of the auxiliary fuel tank aft wall structure that houses the auxiliary tank fill/isolation valve. The housing cover had been crushed against the valve actuator and housing.

(See photograph of "Auxiliary tank fill/isolation valve - housing cover.")

The electrical valve actuator was identified by tag as ITT Aerospace Controls PN AV16E1261D1, SN RN34888. The red external handle on the actuator had received an impact blow from the crushing of the housing cover. The handle/shaft retention pin was sheared, and the handle was moved part way out of the CLOSED position.

(See photograph of "Auxiliary tank fill/isolation valve - actuator handle.")

The valve has a "mean time between unscheduled removals" rate of 64 175 hours (the same as its "mean time between removals rate"). The actuator assembly has a mean time between unscheduled removals rate of 33 194 hours and a mean time between removals rate of 25 534 hours. Boeing has no data on "confirmed" failures versus "no fault found" failures and, therefore, no "mean time between failures" number.

Tail Tank Fill/Isolation Valve

The tail tank fill/isolation electrically actuated gate valve was recovered in a section of the tail fuel tank assembly. The tank mount body assembly was identified as PN 125088E, SN N49896. The valve slide was captured within the valve body and was in the CLOSED position.

(See photograph of "Tail tank fill/isolation valve body.")

The valve actuator housing cover was crushed, causing the electrical valve actuator to break away from the valve. The red actuator handle was aligned with the valve CLOSED position.

(See photograph of "Tail tank fill/isolation valve - electrical valve actuator.")

The actuator support assembly was identified as PN 125144E, SN 51728.

Fuel Crossfeed Valves

The valves were identified by tag as PN AV16E1261D1. The electrical actuators on all three valves were broken off and were not recovered or identified. The valve slide in Exhibit 1-5702 was captured in a mid-open position; however, the position of the slide at the time of impact could not be determined. The valve slides from exhibits 1-5700 and 1-5701 were torn from the valve bodies. A valve slide belonging to either Exhibit 1-5700 or Exhibit 1-5701 was recovered, but it could not be determined which exhibit it belonged to. A determination of the valve slide positions at the time of impact could not be made.

(See photograph of "Fuel crossfeed valves.")

Fuel Pump

All 17 fuel pumps were recovered and taken to the manufacturer's facility (Hydro-Aire, Burbank, California) for examination. The objective of the fuel pump examination was to determine whether the fuel pumps were running at the time of impact. As each pump in each fuel tank is powered by a different electrical power source, it was felt that a determination of pump operation could lead to a better understanding of the aircraft's electrical power distribution at the time of impact.

The condition of the component parts indicated that all 17 pumping units were capable of operating at the time of impact; however, pump SN 7186 would have had reduced performance owing to an open thermal fuse in the phase "A" winding. The pumping units are able to operate with one phase winding inoperative; the reduction in pump performance would not have affected engine operation.

Of the 17 fuel pumps, 15 were matched to a position in the aircraft by SN, by physical matching of the pump flanges, or both. The locations of the remaining two pumps, SN 0908 and SN 1337, were determined by a process of elimination to have been from either the Tank 2 forward boost position or the Tank 3 aft boost position. The fuel pump positions, electrical power sources, and operational status at the time of impact are shown in the following table.

Table: Pumping Units Status

Pumping Unit Position SN Electrical Power Source Operational Status
Tank 1 Forward Boost 7186 115 V AC Generator Bus 1 Operating
Tank 1 Aft Boost 6185 115 V AC Generator Bus 3 Operating
Tank 1 Transfer 7153 115 V AC Generator Bus 2 Undetermined
Tank 2 Forward Boost (or)
Tank 3 Aft Boost
9e+06 115 V AC Generator Bus 1
115 V AC Generator Bus 2
Undetermined
Tank 2 Right Aft Boost 9115 115 V AC Generator Bus 2 Not Operating
Tank 2 Left Aft Boost 7189 115 V AC Right Emergency Bus Undetermined
Tank 2 Transfer 7313 115 V AC Generator Bus 3 Operating
Tank 3 Forward Boost 2252 115 V AC Generator Bus 3 Undetermined
Tank 3 Transfer 6853 115 V AC Generator Bus 1 Operating
Upper Auxiliary Left Transfer 6419 115 V AC Generator Bus 2 Undetermined
Upper Auxiliary Right Transfer 1321 115 V AC Generator Bus 1 Operating
Lower Auxiliary Left Transfer 6885 115 V AC Generator Bus 2 Undetermined
Lower Auxiliary Right Transfer 6958 115 V AC Generator Bus 3 Undetermined
Tail Tank Left Transfer 3631 115 V AC Generator Bus 1 Operating
Tail Tank Right Transfer 2011 115 V AC Generator Bus 2 Undetermined
Tail Tank Alternate Boost 7720 115 V AC Right Emergency Bus Undetermined

(See photographs of "Fuel pump," "Fuel pump - close-up," "Fuel pump housing - rub damage," "Fuel pump impeller - rub damage," "Fuel pump impeller - drive slot damage," and "Fuel pump impeller - drive pin damage.")

Fuel Pump Operation

Determination

Tank 1

Engine Supply Pumps

The operation of both the Tank 1 forward and Tank 1 aft boost pumps was as expected.

Fuel Transfer Pump

It could not be determined whether the pump was running at the time of impact. The pump would normally come on only if there was a need for fuel balancing; therefore, it may not have been running.

Tank 2

Engine Supply Pumps

It could not be determined whether the Tank 2 forward and Tank 2 left aft fuel boost pumps were running at the time of impact. Examination of the Tank 2 right aft boost pump determined that the pump was likely not running at the time. In assessing the operating status of the pumps, the shutdown of Engine 2 and the position of the Engine 2 FUEL switch must be taken into account. If the Engine 2 FUEL switch was in the ON position, then all three Tank 2 boost pumps should have been operating at the time of impact. However, if the Engine 2 FUEL switch was in the OFF position, all three engine supply boost pumps would be expected to be off.

A less likely reason for the Tank 2 boost pumps to be off would be if the FSC were attempting to send fuel to Engine 2 from the main manifold because it was unable to use the Tank 2 fill valve. In that instance, Crossfeed Valve 2 should have been open. The positions of the crossfeed valves could not be determined from a physical examination.

Fuel Transfer Pump

One possible reason for the Tank 2 transfer pump to be operating would be for the rebalancing of the main tanks. Tank 2 was already approximately 1 500 lb higher than tanks 1 or 3, as discussed in Fuel Schedule Management. With the imbalance logic active, tanks 1 and 3 would need to be increased. There are two ways for this to occur. If the upper auxiliary tank quantity was below 2 100 lb, the Tank 2 transfer pump would move fuel from Tank 2 to Tank 1 or Tank 3. Any fuel coming from the upper auxiliary tank would go to whichever tank was being filled. If the fuel quantity in the upper auxiliary tank were equal to or greater than 2 100 lb, then the fuel supply to correct the imbalance would come only from the upper auxiliary tank and the Tank 2 transfer pump would not be expected to be operating. The FSC would disarm the fill valves of the two heavier main tanks and only transfer fuel from the upper auxiliary tank to the lightest main tank until the imbalance was corrected. It is also necessary to note that if Tank 2 were sending fuel to other main tanks, as evidenced by the running transfer pump, it would not have been simultaneously receiving fuel to the engine through its crossfeed valve as mentioned in the paragraph above.

Tank 3

Engine Supply Pumps

It could not be determined whether the Tank 3 forward and Tank 3 aft fuel boost pumps were running at the time of impact. Both pumps should have been operating. If they were not, the loss of the pumps could be related to a loss of electrical power or from having been faulted by the FSC. The Tank 3 forward boost pump is powered by the 115 V AC Generator Bus 3 and the Tank 3 aft boost pump by the 115 V AC Generator Bus 2. If there was an electrical power problem with the 115 V AC Generator Bus 2 and it extended to the DC Bus 2 as well, then both the Tank 1 and Tank 3 outboard fill valves and the Tank 2 crossfeed valve should also have been inoperative.

Fuel Transfer Pump

One possible reason for the Tank 3 transfer pump to be operating would be if the FSC were rebalancing the main tanks and sought to supply fuel from Tank 3. A less likely cause of pump operation would be if the FSC inputs caused the FSC to be in its take-off/land flight phase with the Tank 3 aft pump faulted or without power. In that case, the FSC would command the transfer pump on and the crossfeed valve open, to provide fuel from the aft located pump. In that situation the forward pump should also be operating.

Upper Auxiliary Tank

It could not be determined whether the upper auxiliary tank left transfer pump was running at the time of impact. As the upper auxiliary tank right transfer pump was determined to have been operating, the left pump should also have been operating. The FSC logic always seeks to use both transfer pumps in the auxiliary tanks when it is transferring fuel.

Lower Auxiliary Tank

It could not be determined whether the two lower auxiliary tank transfer pumps were running at the time of impact. The lower auxiliary tank should not have contained fuel, so the two fuel transfer pumps in that tank should not have been running.

Tail Tank

It could not be determined whether the tail tank right transfer pump was running at the time of impact. Since the tail tank left transfer pump was determined to be operating, the right pump should have been operating as well. The FSC logic always attempts to use both transfer pumps in the tail tank when it is transferring fuel from the tank.

It could not be determined whether the tail tank alternate pump was running at the time of impact. The alternate pump is used to supply fuel directly to Engine 2. With Engine 2 shut down, there would be no need for the alternate pump to be running.

Summary

With the FSC operating in Auto mode, between 8 and 11 of the 17 fuel pumps should have been operating at the time of impact. This was derived from a calculation of the aircraft fuel load and distribution at the time of impact, combined with the effects of fuel balancing, the shutdown of Engine 2, and the closed positions of the fuel dump valves. The six fuel pumps that were deemed to be operating at the time of impact were from this category of 8 to 11 pumps. The fact that the remaining pumps in this category could not be classified as operating at the time of impact does not mean that some of them were not, but rather that there was insufficient rotational damage to make this assessment.

Fuel pumping unit SN 9115, which displayed markings to suggest that it was not operating at the time of impact, was determined to be from the Tank 2 right aft boost position. This pump, along with the two remaining engine feed pumps in Tank 2, are designed to be shut off by the fuel system controller if the controller is in the Auto position and the corresponding engine is shut down with the engine FUEL switch.

Fuel Management

Examination

Fuel Schedule Conditions

The expected fuel system operation for SR 111 was analyzed using information from the wreckage, and with the following data and assumptions:

  1. Final ACARS Loadsheet No. 1943 for SR 111 (2 September 1998; JFK-GVA; HB-IWF).
    • Zero fuel weight: 176 847 kg
    • Take-off weight: 241 147 kg
    • Fuel at take-off: 64 300 kg
    • Zero fuel weight MAC: 19.8%
  2. Fuelling Order for SR 111 (2 September 1998; JFK-GVA; HB-IWF).
    • Total fuel load 65 300 kg, at 0.805 specific weight
      • Tank 1: 18 450 kg
      • Tank 2: 27 550 kg
      • Tank 3: 18 350 kg
      • Upper auxiliary tank: 850 kg*
      • Tail tank: 100 kg
    *Note: After engine start and prior to take-off, there would be a short period when the FSC was transferring the 850 kg (1 900 lb) of upper auxiliary tank fuel to the main tanks. Total fuel from the fuelling invoice was 65 300 kg (144 000 lb) and fuel on board at take-off (from the FDR) was approximately 64 300 kg (142 000 lb); therefore, the transfer of fuel from the upper auxiliary fuel tank should have been complete and only main tank fuel would have remained by the time the flight departed New York.
  3. A density of 6.76 lb per US gallon (specific gravity of 0.810)* was used to estimate the fuel quantity distributions in the tanks. Once airborne, the density would tend to increase as the fuel cooled.
    *Note: The specific gravity estimate of 0.810 was used before information from the fuelling order became available. A slightly lower specific gravity (0.805 from the fuelling order) would result in tanks 1 and 3 being full at a slightly lower reading (approximately 41 000 lb) than the 41 300 lb assumed in the summary. This would slightly delay, by perhaps 1 to 2 minutes, the transition from Tank 2 Excess Transfer to All Mains Equal, which occurred approximately 17 minutes after take-off, as described in Fuel Schedule Management Determination, below.
  4. The following data file from the DFDR:
    Time span: From approximately 17 minutes prior to take-off until the recorder stopped.
    Parameters:
    UTC (h/min/s)
    pressure altitude (in feet)
    gross weight (in pounds)
    total fuel quantity (in pounds)
    C of G (% MAC)
  5. The incorporation of Service Bulletin 28-092 on 12 September 1997, which changed the C of G control margin from 2.5% to 2%.
  6. The fuel system was operating in the automatic mode for the entire flight, with the fuel pumps and valves being controlled by the FSC or the FUEL DUMP push button (if selected).
  7. The tail tank and auxiliary tank fill/isolation valves were in the closed position at the time of impact.
  8. The Tank 1 forward and aft boost pumps, the Tank 2 transfer pump, the Tank 3 transfer pump, the upper auxiliary right transfer pump and the tail tank left transfer pump were running at the time of impact. The Tank 2 right aft boost pump was likely not running at the time of impact. An assessment of the operational status of remaining pumps was inconclusive as a result of the lack of rotational damage.
  9. The positions of the three fuel system crossfeed valves could not be determined.
  10. The slats and landing gear were in the retracted position at the time of impact.
  11. FADEC fault information indicated that Engine 2 had been shut down with the FUEL switch prior to impact.
  12. For the purpose of simplifying the estimation of tank quantities, it was assumed that tanks 1 and 3 were kept full continuously by Tank 2 during the early part of the flight. These tanks will refill periodically, as the high-level shutoff floats allow the fill valves to open. During the early part of the climb, the quantity in these tanks may decrease by 1 000 to 2 000 lb before the floats allow refilling. This is primarily owing to the high nose-up attitude during take-off and initial climb. In the later portion of climb and during cruise, the tanks tend to refill once they are 500 to 1 000 lb below full. Therefore, individual fuel tank quantity estimates are approximate and could vary by ± 1 000 lb.
  13. The aircraft was equipped with a –907 FSC. The –907 FSC is designed to transfer tail fuel forward as the aircraft descends through 26 750 feet with a minimum initial descent rate of more than 600 fpm, then a steady rate of more than 400 fpm with more than 500 lb of fuel in the tail and less than 90 000 lb of fuel on board. With more than 90 000 lb of fuel on board (as in the case of SR 111) and under the same descent rate conditions, the –907 FSC would start this tail fuel forward transfer sequence as the aircraft descended through 19 750 feet.

Determination

Fuel Schedule Management

The data on the DFDR begins approximately 17 minutes prior to take-off, with the total fuel quantity at 143 200 lb. C of G is at 23.2% MAC. This was assumed to be just after engine start. Normal fuel distribution at this time would be as follows: tanks 1 and 3 both full, with approximately 41 300 lb in each, and Tank 2 with approximately 60 600 lb (approximately 93% full). The upper and lower auxiliary tanks and the tail tank would be empty. In this condition, the FSC would have the aft boost pumps operating in all three main tanks (four pumps in total). In addition, the Tank 2 transfer pump would be operating and the fill valves of tanks 1 and 3 would be armed. This would allow fuel from Tank 2 to transfer to tanks 1 and 3 as the high-level shut-off floats in those tanks permitted the fill valves to open. This is normal fuel scheduling where the extra fuel in Tank 2, which has more capacity that tanks 1 and 3, is transferred to tanks 1 and 3 until all three main tanks are equal.

The total fuel quantity at take-off was 142 000 lb, with a C of G of 23.4% MAC. In take-off, the FSC will turn on the forward boost pumps in the main tanks. The aft boost pumps and the Tank 2 transfer pumps would remain on and the fill valves for tanks 1 and 3 would remain armed. Estimates of the fuel quantities in the main tanks at this time would be 41 300 lb in each of tanks 1 and 3, and 59 400 lb in Tank 2.

Once the landing gear and slats have both been retracted, the FSC would exit its take-off/landing flight phase. The forward boost pumps in the main tanks would be turned off and tail fuel management would begin. With the fuel distribution at take-off, the FSC would initially begin filling the tail tank with the extra fuel from Tank 2. The Tank 2 transfer pump would be used for this process. The auxiliary and tail fill/isolation valves would be opened and the tail tank fill valve would be armed and opened to fill the tail tank. The DFDR data shows the C of G beginning to move aft approximately 3 to 4 minutes after take-off.

During the process of filling the tail tank, the quantity in Tank 2 would become equal with tanks 1 and 3. This condition is estimated to have occurred approximately 17 minutes after take-off at a total quantity of 130 800 lb with the C of G at 27.2% MAC. At this time tanks 1, 2, and 3 would contain approximately 41 300 lb each and the tail tank would contain approximately 7 000 lb of fuel. When this condition occurred, the FSC would change configurations. The Tank 2 transfer pump would remain on, but the fill valves for tanks 1 and 3 would be disarmed. Tanks 1 and 3 transfer pumps would be turned on and fuel would now be supplied to the tail tank from all three main tanks.

The next fuel system event on the DFDR data is the occurrence of a normal water scavenge transfer from the tail tank. This occurred approximately 30 minutes after take-off, with the total fuel quantity at 127 200 lb. At this time tanks 1, 2, and 3 would contain approximately 38 000 lb each and the tail tank approximately 13 000 lb, with the aircraft C of G at 31.3% MAC. The FSC would then reconfigure the fuel system in the following sequence: there would have been no change to the main tank boost pumps; that is, the aft pumps would be on and the forward pumps off; the tail tank's fill valve and the tail tank fill/isolation valve would be disarmed and closed; the auxiliary tank fill/isolation valve would remain open; the two tail tank transfer pumps would be turned on and the three main tank transfer pumps would be turned off; the Tank 2 fill valve would be armed and fuel would be transferred from the tail tank to Tank 2.

After approximately 1 500 lb of fuel were transferred, the transfer out of the tail would be discontinued. The tail would then be refilled with fuel from all three main tanks. The DFDR data indicates that the refill process began approximately 3 to 4 minutes after the forward transfer started. The re-configuration would be as follows: the Tank 2 fill valve would be disarmed and closed; the tail tank fill valve and tail tank fill/isolation valves would be reopened; the main tank transfer pumps would be turned on; and the tail transfer pumps would be turned off. When this process was completed, approximately 38 minutes after take-off, the total fuel quantity was at 124 000 lb. At this time tanks 1 and 3 would contain approximately 36 400 lb, Tank 2 approximately 37 900 lb, and the tail tank approximately 13 000 lb. The FSC would not rebalance the main tanks unless there was at least a 2 400 lb difference between any two main tanks.

The aircraft reached the top of its climb approximately 39 minutes after take-off, with the C of G at 31.6% MAC. The aircraft C of G was at the forward end of its 2.0% control margin, indicating that the tail tank had been completely filled. (See chart of "Centre of Gravity (C of G) data plot.") The FSC would then discontinue fuel transfer to the tail tank and would close/disarm the tail tank fill valve and the auxiliary tank and tail tank fill/isolation valves. All of the main tank transfer pumps would be turned off. Only the aft boost pumps in the main tanks would remain on, and all valves would be closed. The total fuel quantity at this time was 123 200 lb. The estimated tank quantities were 36 100 lb in tanks 1 and 3, 37 600 lb in Tank 2, and 13 400 lb in the tail tank.

The aircraft continued in cruise for another 19 minutes until the descent began, approximately 58 minutes after take-off. The total fuel quantity was 118 200 lb and the aircraft C of G was 31.5% MAC. Fuel distribution should have been approximately 34 400 lb in tanks 1 and 3, 36 000 lb in Tank 2, and 13 400 lb in the tail tank. In the initial descent, the only change to the fuel system configuration would be that the FSC would turn on the forward boost pumps in the main tanks.

Fuel transfer out of the tail tank would begin when the aircraft's altitude decreased below 19 750 feet. This altitude transition occurred approximately 1 hour and 3 minutes after take-off. Total fuel quantity was 117 600 lb and the aircraft C of G was at 31.5% MAC. Fuel distribution should have been approximately 34 200 lb in tanks 1 and 3, 35 800 lb in Tank 2, and 13 400 lb in the tail tank. The FSC's primary selection for a transfer path would be to send the tail fuel directly to the main tanks by opening the auxiliary fill/isolation valve, thereby executing the tail transfer task while staying on schedule and avoiding a rescheduling task. Since the auxiliary fill/isolation valve was found in the closed position and the upper auxiliary tank right transfer pump was operating, the FSC had probably moved to its second choice in the transfer path, which would turn on the two tail transfer pumps and move fuel from the tail tank directly to the upper auxiliary tank. Once the fuel level in the upper auxiliary tank was above 700 lb for more than 20 seconds, the FSC would command the upper auxiliary tank pumps on to begin to move fuel to the main tanks. Initially, while the quantity of fuel in the upper auxiliary tank was less than 2 100 lb, the FSC would treat this transfer as a "purge" of the upper auxiliary tank. As such, the FSC would arm the Tank 2 fill valve and open the Tank 1 and Tank 3 outboard fill valves. The upper auxiliary tank would not immediately transfer fuel to the main tanks. This tank is very large, and it takes some time for the fuel to make its way from the fill valve outlet to the pump inlets. Once the fuel pumps begin to pick up fuel, they may transfer intermittently. Therefore, while the flow of fuel into the tank would be steady, the flow of fuel out of the tank would not be steady, initially. The quantity would tend to continue to increase in the upper auxiliary tank until the pump inlets in that tank were continuously covered with fuel. If the quantity rose to 2 100 lb or more, the FSC would change the condition of the tank from a "purge" to a "low" tank with an off-schedule condition. This would cause the outboard fill valves to be closed and all three main tank fill valves to be armed.

For the next five minutes (until the end of the FDR data) the aircraft C of G began a steady forward movement. During this time aircraft C of G moved from 31.5% MAC to 29.5% MAC. This is consistent with the movement of approximately 3 000 to 3 500 lb of fuel out of the tail tank. The last total fuel quantity in the FDR data was 116 200 lb, and the last aircraft C of G was 29.5% MAC. Fuel transfer out of the tail tank should have continued until either the slats or the landing gear were extended. Without the extension of either the slats or landing gear, fuel transfer should have continued until the time of impact, at which time the tail tank would have contained 5 000 to 7 000 lb of fuel.

Auxiliary Tank Fill/Isolation Valve

Closed Scenarios

The determination that the auxiliary tank fill/isolation valve was in the closed position when the flight ended was unexpected. As discussed in the previous section, fuel should have been transferring from the tail tank to the main tanks through this valve. Finding it closed suggests that either the FSC sensed that there was still fuel in the upper auxiliary tank, that the valve had failed or was without electrical power to open, or that a fuel dump had been initiated.

If, for some reason, the FSC did not initiate or complete the 850 kg transfer of fuel from the upper auxiliary tank to the main tanks after engine startup, then the FSC would send fuel from the tail tank to the upper auxiliary tank. This scenario is unlikely, as the FSC would sense an off-schedule condition and would continually try to remove this fuel. If it could not, the FSC would have reverted to manual mode during the early part of the flight, which is not supported by DFDR information.

It is possible that the valve failed, but is unlikely, as DFDR data show that the valve was operating properly approximately 37 minutes into the flight, during the tail fuel tank fill process and the tail tank water scavenge cycle.

Electric power for the auxiliary tank fill/isolation valve is redundantly supplied from the battery bus and the battery direct bus. A loss of power to both of these buses or loss of individual circuits could account for the valve being closed; however, the loss of power would have to have occurred prior to the start of the tail fuel transfer, as the aircraft was descending through 19 750 feet. DFDR information does not support a loss of these buses at that time.

The FSC controls the auxiliary tank fill/isolation valve through Relay R2-5272. The control circuitry for Relay R2-5272 is installed below the floor from the main avionics rack shelf to the centre accessory compartment in an area that showed no heat or fire damage. Relay R2-5272 receives its power from the battery bus through the fuel tank fill valves and Battery Bus Sensing CB B1-474 at location B-29 on the overhead CB panel. Relay R2-5272 is redundantly powered by the battery direct bus through the Ground Refuel Power CB B1-475 at location A-29 on the overhead CB panel. Both of these CBs were located in an area of high heat, in the range of 650 to 1 150°F. CBs trip at approximately 350°F, making the thermal tripping of these CBs a likely event. The fuel tank fill valves and Battery Bus Sensing CB B1-474 was recovered with soot accumulation on the white CB indicator ring, which indicates that the CB had tripped some time before impact. The Ground Refuel Power CB B1-475 was not recovered. The CBs are located on the outer right edge of the upper two rows of the overhead CB panel beyond a bend in the panel and in an area behind and above the flight crew seats. The CBs are difficult for the flight crew to see while they are seated in the their seats.

The power wires for the auxiliary tank fill/isolation valve from CBs B1-474 and B1-475 are located in the same wire runs (AMP, AMK, and AMJ) from the overhead CB panel, through the exit hole in the right side of the overhead switch panel, to connector P1-398 (pins "e" and "g") on the right overhead disconnect switch panel located behind the avionics upper CB panel. These wires are co-located in the wiring run AMK, which was known to have an electrical arcing event outside of the overhead switch panel

During simulator trials, the fuel tank fill valves and Battery Bus Sensing CB B1-474 and the Ground Refuel Power CB B1-475 were tripped to see what cockpit indications occurred. Neither CB trip provided an alert on the DU-3 EAD, nor a cue light on the SDCP. When the status page on the SDCP was manually selected, a Level 1 maintenance alert on the synoptic page on DU-4 appeared, indicating a Fuel Valve Fault. If the status page was not selected, the Fuel Valve Fault would remain a hidden event to the crew. The DFDR did not record a status page selection during the flight; however, this parameter is only sampled every 64 seconds.

When a fuel dump is initiated, the auxiliary tank fill/isolation valve is commanded closed. In this case, with tail fuel being transferred forward, the auxiliary tank fill/isolation valve should have been open, and would have been commanded closed. The tail fuel would then be re-directed to the upper auxiliary tank. When 2 100 lb of fuel had been transferred to the upper auxiliary tank, the FSC would have been configured to the "Reschedule" mode. In the "Reschedule" mode, if the fuel dump was terminated, the FSC would not attempt to re-open the auxiliary tank fill/isolation valve and the auxiliary tank fill/isolation valve would be expected to be in the closed position at the time of impact.

If it can be established that fuel dump had been started, then the normal FSC command to close the auxiliary tank fill/isolation valve would be the most likely reason for the valve to be in the closed position at the time of impact.

If fuel dump had not taken place, then the most likely reason for the valve to be closed at the time of impact would be that the valve was without electrical power to open.

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

Hydraulic System

  1. Hydraulic System Description
  2. Hydraulic System Examination
    1. RMP Examination
    2. RMP Determination
  3. Hydraulic System Determination

Hydraulic System Description

The MD-11 hydraulic system consists of three parallel, continuously pressurized systems that operate between 2 800 and 3 200 psi. All three systems power each of the primary flight controls. Combinations of two of the three systems supply parallel power to the remaining flight controls, nosewheel steering, and wheel brakes.

(See illustration of "Simplified hydraulic system - schematic.")

Hydraulic System 2 shares control over the following hydraulic actuators: the left and right outboard elevator; the left inboard elevator, and the left and right outboard ailerons; the left inboard aileron; the left and right inboard and outboard flaps; and the spoiler drive actuator. Hydraulic System 2 has full control over the Engine 2 thrust reverser, the lower rudder actuator, and spoilers 1 and 5 on both the left and right wings.

Each system is powered by two EDPs. Two electrically driven auxiliary hydraulic pumps, 1 and 2, supply hydraulic pressure to Hydraulic System 3 on the ground or in flight. When electrically powered by the ADG, Auxiliary Pump 1 can provide emergency hydraulic power to Hydraulic System 3. Two RMPs, the 1-3 RMP and the 2-3 RMP, connect Hydraulic System 3 to hydraulic systems 1 and 2. In the event of a loss or shutdown of an engine or a decrease in engine speed, the RMPs can transfer power from an operating system to an inoperative system without transferring any fluid through the openings of their respective shut-off valves. Landing gear hydraulic power is supplied by Hydraulic System 3 or, if Hydraulic System 3 is unavailable, by either RMP.

When the RMP shut-off valves are in the closed position, the RMPs are non-operational. Power to open and close the RMP valves is supplied by the battery bus through CBs B1-599 and B1-598, located in the overhead CB panel at positions A-04 and A-05, respectively. Wires from both CBs are routed through connector P1/R5-394, located in the overhead disconnect panel, and then down the right side of the fuselage behind the right observer's station to the HSC in the avionics compartment.

Two NRMPs, namely the 2-1 NRMP and the 3-2 NRMP, automatically transfer hydraulic power to the rudders and to the stabilizer trim.

Under normal conditions, the HSC controls hydraulic power and operates in the auto mode. The HSC can be switched to manual mode through a push-button selection on the hydraulic system control panel. In the event of a loss of electrical input to the HSC's Channels A and B, the HSC will automatically revert to manual mode. In manual mode, the RMP valves are automatically opened and both RMPs are commanded ON.

The HSC Channel A is powered by the 28 V  DC Bus 3 through CB B1-373, located at position S-3 on the upper main CB panel. The HSC Channel B is powered by the 115 V AC Bus 2 through CB B1-372, located at position M-3 on the upper main CB panel. In auto mode, the HSC is designed to configure the hydraulic system based on the phase of flight.

In the landing configuration (i.e., the aircraft is in the air at a barometric-corrected altitude ≤ 17 750 ft., and either the slats or landing gear are extended or the flaps are extended greater than 0 degrees), both RMPs will be commanded ON when the HSC detects a drop in any of the engine speeds below 45% N2. Independent of the engine speed, if the HSC senses a drop in hydraulic pressure below 2 400 psi, it will automatically open the applicable RMP valve and the RMP will be commanded ON. In the event of multiple failures, the HSC is programmed to respond to a loss or shutdown of an engine, or a decrease in engine speed, before responding to a loss of system pressure.

In the cruise configuration, the HSC will not reconfigure the hydraulic system in the event of a loss or shutdown of an engine, or a decrease in engine speed. The RMP valves will remain closed. The HSC receives flap data from the DEUs; according to HSC logic, a loss of flap data will default the flap data to the retract configuration.

Hydraulic System Examination

The examination of the upper main CB panel determined that it had not been subjected to heat or fire damage. The wires from both CBs to the HSC were not routed through an area of fire damage. Based on the functioning of other mechanisms (e.g., fans, pumps) dependent on the same power supply, it was determined that the 115 V AC Bus 2 supply for the HSC Channel B was available at the time of impact. As it is likely that at least Channel B was powered at the time of impact, the HSC should have, other than by crew selection, remained in auto mode. As there was no indication of a failure associated with the hydraulic systems, the crew would not have had a need to select the manual mode. The wires from RMP shut-off valve CBs were routed through an area of fire and high heat behind the upper avionics CB panel.

RMP Examination

Both of the RMPs were recovered intact and were identified by tag or data plate as PN BYG7001-5511K. Only one RMP had retained a legible serial number: SN 138538A. Since the SNs of the two RMPs could not be found in the aircraft technical documents, the RMPs could not be linked to a specific location (i.e., the 1-3 or the 2-3 position).

On one RMP (SN 138538A), the two motor-operated shut-off valves were still attached to the pump and the valves were in the normal closed position. The two electric motors had broken off from the valves and were not recovered; the actuator base for one of the motors, however, was still attached to the valve. A portion of the handle cover plate was still in place and the red actuator handle was in the closed position. There was no damage to the handle to indicate that the handle was in other than the normal closed position at the time of impact.

(See photographs of "Reversible motor pump" and "Reversible motor pump - close-up.")

On the other RMP, one motor-operated shut-off valve was still attached to the pump and the other was recovered as a separate unit. Both valves were recovered in the normal closed position. The two electrical motors had broken off from the valves and were not recovered; the actuator base for one of the motors, however, was still attached to the valve. The red actuator handle was in the closed position and there was no damage to the handle to indicate that it was in other than the normal closed position at the time of impact.

(See photograph of "Second reversible motor pump.")

RMP Determination

As the aircraft was in the landing configuration phase of flight at the time of impact (the flaps were extended) (STI) and it had been determined that Engine 2 had shut down prior to impact, (STI) the HSC should have opened one or both of the RMP valves. The unexpected closed position of the 1-3 and 2-3 RMP valves may have been caused by one of several scenarios:

  • A loss of DEU data to the HSC. In the event of a total loss of DEU data, the HSC will revert to a cruise configuration. A partial loss of DEU data (flap input) will cause the HSC to switch to the flaps retract mode. With a loss of flap data and the slats and landing gear retracted, the HSC will also revert to, or stay in, a cruise configuration. In either case, when the HSC is in the cruise configuration, the RMPs will not be commanded ON with the shutdown of Engine 2, even with a drop in system pressure below 2 400 psi.
  • A loss or interruption of electrical power to the RMP valves. This would prevent the RMP valves from opening. The RMP valve's CBs are electrically powered by the battery bus. Since the Engine 2 FUEL switch is also electrically powered by the battery bus and was required for the shutdown of Engine 2, it is unlikely that a loss of battery bus power prevented the RMP valves from opening. A loss of electrical power could be caused by heat or fire, and could either trip the RMP valve CBs, or short or open the wiring from the CBs to the HSC.
  • A loss of N2 input to the HSC. With the loss of N2 input, the HSC would not receive data indicating an engine shutdown. In this case, and if the HSC reverts to the land configuration (with the extension of the flaps), the 2-3 RMP valve would only be opened in response to a System 2 pressure drop below 2 400 psi, and the 1-3 RMP would also remain closed. In this scenario, Hydraulic System 2 pressure would have to remain above 2 400 psi after the shutdown of Engine 2.

Hydraulic System Determination

An examination of the six hydraulic EDPs found no faults with the pumps that would have affected their operation. With engines 1 and 3 running, hydraulic systems 1 and 3 should have been operational.

With the shutdown of Engine 2 (via the engine FUEL switch), in the land configuration phase of flight and the HSC selection in auto mode, both Engine 2 hydraulic EDPs would have remained in the normal position when the engine speed dropped below 45% N2. If the same conditions had occurred in the cruise configuration, the HSC would have turned off the EDPs.

With Engine 2 shut down (minimal rotation) and the 2-3 RMP not operating, Hydraulic System 2 pressure would only be retained by the Hydraulic System 2 pressure accumulator. Any pressure demand on Hydraulic System 2 (e.g., to the flaps, aileron, elevator, rudder, spoiler, or thrust reverser) would cause Hydraulic System 2 pressure to drop. A drop in Hydraulic System 2 pressure would subsequently cause the 3-2 NRMP to be commanded ON through a pressure operated valve. With the 3-2 NRMP operating, hydraulic pressure to the lower rudder actuator would be maintained. In the event of a shutdown of Engine 2, the loss of hydraulic pressure to the Engine 2 thrust reverser would be of little consequence, as there would not be any thrust supplied by the engine for thrust reverser action once on the ground. The loss of spoilers 1 and 5 would have little effect on lateral control, as the remaining three spoilers on the wing would be operational, the outboard aileron actuators would be active (with flap extension), and spoiler control would not come into effect until the aileron deflection exceeded five units. Control of the primary and secondary flight control actuators, parallel with Hydraulic System 2, would be picked up by the other operating system. In view of the above factors, it was determined that a loss of, or reduction in, Hydraulic System 2 operating pressure would have had little or no adverse effect on aircraft operation.

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

Landing Gear

  1. Landing Gear System Description
  2. Landing Gear System Examination
    1. Main Landing Gear
      1. Left Main Landing Gear
      2. Right Main Landing Gear
    2. Center Gear
    3. Nose Gear
  3. Landing Gear System Determination

Landing Gear System Description

The landing gear system consists of two main gear (left and right main landing gear), a center gear, and a nose gear. The left and right main landing gear incorporate a four-wheel twin bogie beam assembly with individual wheel brakes. The center gear incorporates a dual wheel assembly with individual wheel brakes. The nose gear has a steerable shock strut with dual wheels and no brakes. The left and right main landing gear retract inward and, in the stowed position, the gear strut is aligned horizontally with the wheels oriented inboard. The forward wheel assemblies on the left main landing gear are numbered 1 and 2, and the aft wheel assemblies are numbered 5 and 6. The forward wheel assemblies on the right main landing gear are numbered 3 and 4, and the aft wheel assemblies are numbered 7 and 8. The center gear retracts forward, and the wheel assemblies are numbered 9 and 10. The nose gear retracts forward and, in the stowed position, the shock strut is inclined slightly upward.

The landing gear system is hydraulically operated. Hydraulic System 3 provides normal gear extension and retraction.

Landing Gear System Examination

Main Landing Gear

Left Main Landing Gear

The left main landing gear was recovered as a single unit.

(See photograph of "Left main landing gear.")

The upper trunnion pivot points were attached to the landing gear wing box structure, which had torn free from its surrounding structure. The landing gear was in the stowed position as oriented to the wing box structure. The landing gear assembly was intact; the truck beam and its four wheel and tire assemblies were attached. Tires 1, 2, and 5 were ruptured and deflated. Tire 6 was inflated. The fixed side brace link, the upper and lower side brace links, the downlock link, and the retract cylinder were attached and oriented in the retracted position.

(See photograph of "Left main landing gear - actuator in stowed position.")

Right Main Landing Gear

The right main landing gear was recovered in several pieces.

(See photograph of "Right main landing gear and center gear.")

The upper trunnion pivot points were attached to the landing gear wing box structure, which had torn free from its surrounding structure. The landing gear was in the stowed position as oriented to the wing box structure. The lower truck assembly was detached from the lower strut and was fractured in numerous locations. Wheel assemblies 3 and 4 were separated into individual components. The rim of Wheel Assembly 4 was fractured into small segments and the tire was detached. Wheel Assembly 3 was intact, but the tire was ruptured and deflated. Wheel assemblies 7 and 8 were detached from the truck assembly as a unit. Both tires were ruptured; Tire 8 exhibited greater damage. The upper and lower side braces, the downlock link, and the retract cylinder were intact. The upper end of the upper side brace was detached from the support structure and the side brace was pulled away from the strut. The retract cylinder had a partial extension of 60 mm, which is consistent with the movement of the lower gear leg at the time of impact or during the recovery phase.

(See photograph of "Right main landing gear - actuator partially extended.")

Center Gear

The center gear was extensively damaged and was recovered in several pieces. The retract actuator had broken away from the gear assembly and the actuator was in the fully retracted position.

(See photograph of "Center gear - actuator retracted.")

The strut assembly was detached from the upper strut housing. The lower leg assembly was intact, but tires 9 and 10 were ruptured and deflated.

Nose Gear

The nose gear was recovered in several pieces. The upper trunnion pivot points were attached to structural support members. The nose gear actuator had separated from the nose gear assembly and the actuator was in the fully retracted position.

(See photograph of "Nose gear - actuator retracted.")

The left tire and wheel assembly were detached, and the axle was fractured at mid-span.

(See photograph of "Nose gear.")

The right wheel was attached to the axle and the tire was torn free from the rim. The strut was fully compressed; the strut air valve and cylinder cap were not recovered.

(See photograph of "Nose gear strut - air valve cylinder cap location.")

The strut outer cylinder wall had two longitudinal cracks—one on the right side of the strut between the trunnion frames, (see photograph of "Nose gear - upper strut (cracked)") and one on the left side of the strut below the trunnion lower frame (see photograph of "Nose gear - lower strut (cracked)").

The damage to the strut outer cylinder wall and to the strut air valve is consistent with the lower leg assembly being driven rearward into the strut housing with the landing gear in the retracted position.

Landing Gear System Determination

An examination of the landing gear system indicated that all four landing gear assemblies were in the stowed position at the time of impact. The right main landing gear displayed greater overall damage than the left main landing gear.

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

Lighting Systems

  1. MD-11 Aircraft Exterior Lights
    1. Description
      1. Nose Lights
      2. Landing Lights
      3. Runway Turn-Off Lights
      4. Navigation Lights
      5. Beacon Lights
      6. Wing and Engine Scan Lights
      7. High-Intensity Supplemental Lights
      8. Logo Lights
  2. Emergency Lighting System
    1. Description
      1. Emergency Lighting System Battery Packs
      2. Forward Cabin Emergency Lighting System Battery Pack
  3. Flight Crew Reading Lights (Map Lights)
    1. Description
      1. Map Light Wire Routing
    2. Examination
      1. First Officer's Map Light
      2. Right Observer's Map Light

MD-11 Aircraft Exterior Lights

Description

Nose Lights

There are two fixed lights located on the nose gear support assembly. The nose lights are interlocked with the landing gear handle and will only illuminate when the landing gear handle is in the DOWN position. The nose lights are dual element and can be selected to either the LAND position (600 W) or to the TAXI position (400 W).

(See illustration of "Aircraft exterior lights.")

Landing Lights

These retractable landing lights, which operate independently of the landing gear, are located on the forward section of the fuselage.

Runway Turn-Off Lights

These lights provide additional side and forward lighting during taxiing, runway turn-off, and in flight.

Navigation Lights

The navigation lights consist of a red light on the left wingtip, a green light on the right wingtip, and a white light on the trailing edge of each wingtip.

Beacon Lights

The beacon lights consist of two red flashing lights on the fuselage: one on the top and one on the bottom.

Wing and Engine Scan Lights

These lights illuminate Engine 1 and Engine 3, the wing leading edges, and wing surfaces.

High-Intensity Supplemental Lights

These lights consist of two forward-facing strobe lights and one aft-facing strobe light on each wingtip.

Logo Lights

These lights are installed in the horizontal stabilizers to illuminate the airline logo on the vertical stabilizer.

Emergency Lighting System

Description

The emergency lighting system includes the following lights:

  • Cockpit ceiling lights
  • Cabin ceiling lights
  • Exit sign lights
  • Door handle lights
  • Aisle lights
  • Floor escape path lights

When armed, the lighting system illuminates automatically when power to the AC ground service bus is lost. The emergency lighting system can also be turned on manually from the cockpit or from the left mid-cabin attendant panel. The cabin EMER LT switch overrides the cockpit EMER LT switch. The MSC operates the emergency light battery test function and monitors the voltage of the batteries.

When the cockpit EMER LT switch is in the OFF position (normal for ground operations), the output to the emergency lights is open, but the input to the battery charger is closed. As a result, the battery charger continuously supplies power to the battery pack when the right emergency 115 V AC bus is energized. Therefore, when the cockpit EMER LT switch is in the OFF position, the batteries will not discharge as a result of a loss of electrical power.

When the cockpit EMER LT switch is in the ARM position (normal when in flight), the battery packs detect 115 V AC emergency control voltage from the 115 V AC ground service bus phase A. If the battery packs no longer detect this ground service control voltage, they enter a standby mode. The battery packs switch first to either the right emergency 115 V AC bus phase B (115 V AC is converted to 28 V DC) or to the left emergency 28 V DC bus if the right emergency 115 V AC bus is not available. If neither of these two standby power sources are available, the battery packs revert to internal battery power supply.

Emergency Lighting System Battery Packs

Description

The aircraft is equipped with six emergency lighting system battery packs. One is located in the forward cabin drop-ceiling area, two are located in the mid-drop-ceiling area, two are located in the overwing drop-ceiling area, and one is located in the aft drop-ceiling area. The emergency battery packs were manufactured by Grimes Aerospace Co. under PN 60-4411. The battery packs are self-contained power supplies. One battery pack consists of 24 series-connected, nickel cadmium batteries. The solid state circuits control the operation and recharging of the battery pack.

Examination

Numerous pieces of the various battery packs were recovered, ranging from an almost intact battery pack to individual assemblies. Four of the individual assemblies exhibited heat damage.

Determination

As the heat and fire damage was confined to the forward area of the aircraft, it was determined that the four pieces were likely parts of the battery pack located in the forward cabin drop-ceiling area.

Forward Cabin Emergency Lighting System Battery Pack

Description

The forward cabin emergency lighting system battery pack was installed on top of the forward cabin drop-ceiling panel that was located immediately aft of the cockpit door.

Examination

The four recovered, heat-damaged parts were individually identified as exhibits 1-5418, 1-2846, 1-8007, and 1-5460, and then combined into one exhibit, 1-10581, for inclusion in the reconstruction mock-up. For identification purposes, the four assemblies were compared to Exhibit 1-4929, a relatively intact battery pack identified as being installed in the aft drop-ceiling. All PNs and component numbers were obtained from the Grimes Aerospace Component Maintenance Manual.

Exhibit 1-5418

Exhibit 1-5418 was a piece of deformed aluminum panel identified as
PN 61-3591-3 that formed three sides of the battery pack outer housing. The majority of the black paint on the inner and outer surfaces of the panel was missing; the majority of the aluminum panel exhibited a brownish discolouration. Aluminum panels from other battery packs were heated for comparison purposes; the colour of Exhibit 1-5418 matched those samples heated to 480°C. The electrical schematic and data plate originally attached to the panel were not recovered with the exhibit.

Exhibit 1-2846

Exhibit 1-2846 was the fourth side of the battery pack and consisted of an outer housing assembly PN 61-3179-1, a circuit card assembly
PN 61-3379-1, and an inner housing PN 61-3380-1. The exhibit was divided into two pieces; the outer housing contained the J1 and J2 electrical connectors and the attached airframe connectors, and the inner housing was still attached to the circuit board. The deformation of the panels held the two pieces together. The J1 and J2 connector pins had pulled out of their mating components on the circuit board. The black paint on both sides of the inner housing exhibited heat damage. Although the silicon rubber grommets on the inside of the J1 and J2 connectors exhibited impact marks and the J1 grommet was slightly blackened from heat, both grommets remained resilient. The airframe electrical plugs attached to J1 and J2 were blackened from heat and soot exposure. Resolidified aluminum was trapped between the outer surface of the housing and the J2 connector. The melted aluminum was consistent with aluminum alloy 2024.

Most of the J1 airframe connector grommet was not recovered. The remaining grommet remnants inside the connector were an ash colour. The connector was oval in shape as a result of impact damage. Parts of the J1 connector's seven polyimide-insulated, nickel-plated wires (originally attached in a harness) were recovered in lengths varying from 1.5 to 3.5 inches and exhibited mechanical fractures. Only 0.4 to 0.8 inches of wire insulation remained on these wires; the majority of the wire insulation was inside the connector, protected by the grommet material. The polyimide insulation that remained on the wires, just aft of the back shell, was blackened, which corresponded to the oven samples heated to 500°C. The nickel plating on the exposed wire strands remained largely intact. The end of one wire was discoloured and brittle. There was no evidence of melted copper on any of the seven wires. The back shell of the connector did not exhibit any arcing damage.

The J2 airframe connector exhibited similar heat and soot damage as the J1 connector. Seven wire segments varying in length from 0.8 to 5.9 inches were still attached to the connector; one of the wires was a jumper between two pins. The polyimide insulation was missing on these wires from approximately 0.4 inches aft of where the rear rubber grommet had been installed. The polyimide film on the wires within the grommet did not exhibit discolouration as a result of heat damage. The polyimide film remaining aft of the grommet was blackened and corresponded to polyimide film oven samples heated to 500°C. The nickel plating on the exposed wire strands remained intact. The jumper wire was slightly brittle in some localized areas approximately 2 inches aft of the plug. None of these wires exhibited evidence of melted copper. The back shell of the connector did not exhibit any arcing damage. There was considerably more of the silicon rubber grommet remaining in the J2 connector than in the J1 connector. This grommet material was spongy and had lost its resilience.

The black, painted interior surface of the inner housing exhibited a heat transition zone from bottom to top and from left to right with the highest heat zones located at the top and left sides of the housing. The hardware installed along the bottom edge to facilitate installation of the battery pack into the cabin drop-ceiling panel inserts exhibited a dark discolouration on the anodized knobs. The left knob exhibited darker discolouration than the right knob. The cabin drop-ceiling panel inserts had separated from the drop-ceiling and remained attached to the battery pack mounting hardware. The ceiling panel inserts had a darkened, rust-like appearance. The left insert exhibited greater discolouration than the right insert.

The circuit card assembly remained attached to the inner housing. The conformal coating on the surface of the circuit board on the outer side of the housing was missing as a result of heat damage that exposed the printed circuit foil. The left side of the printed circuit board exhibited greater heat damage than the right side. The resins used in the construction of the circuit board had been volatized out of the fibreglass, which was discoloured to black. The resin on the upper edge of the printed circuit board was also volatized out of the fibreglass, which was discoloured to black. The left half of the printed circuit board exhibited greater discolouration as a result of heat than the right side. The two electrical receptacles normally soldered to the printed circuit board had separated from the board and remained attached to the inner housing.

Exhibit 1-8007

Exhibit 1-8007 was the circuit card assembly PN 61-3003-3 that had been attached to the inner surface of the fourth side of the sheet aluminum housing. The circuit board had separated from the housing and exhibited impact damage but little heat damage. The conformal coating remained intact over most of the board. The upper right corner exhibited some localized heat damage to the resin in the fibreglass and discolouration of the fibreglass portion of the printed circuit board as a result of heat. The two screws on the heat sink assembly used to mount the circuit board to the inner surface of the fourth side of the housing remained attached to the heat sink on the circuit board and had pulled out of the housing as a result of impact. One of the four support posts used to mount the circuit board remained attached to the circuit board and had pulled out of the housing as a result of impact. The remaining three support posts were not recovered.

Exhibit 1-5460

Exhibit 1-5460 was the top of the battery pack, a finned, aluminum heat sink assembly PN 61-3177-1 with the circuit card assembly PN 61-3001-3 still attached to it. Since most of the mounting screws between the heat sink cover and the printed circuit board were not accessible as a result of impact damage to the fins on the heat sink cover, the printed circuit board was not separated from the heat sink. The circuit board PN 61-3001-1 exhibited extensive damage; numerous components were displaced. The fibreglass resins had been volatized and the four corners of the circuit board were delaminated and exhibited heat damage.

The heat sink assembly PN 61-3177-1 was deformed and the cooling fins on the top were bent over as a result of impact damage. The fins on the heat sink were deformed, primarily from the back edge of the battery pack toward the forward edge that contained the electrical connectors. The black paint on the heat sink did not exhibit discolouration resulting from heat damage. A considerable amount of material was trapped between the bent fins, including resolidified aluminum, a small bead of copper, and small stones likely captured or wedged in place after the accident. The resolidified aluminum pieces ranged in length from 0.4 to 1.2 inches. One of the pieces had formed into a drop of aluminum. Samples from four of the aluminum pieces were removed and identified as exhibits 1-10590, 1-10591, 1-10592, and 1-10593. It was determined that the four samples were consistent with aluminum alloy 6061. A small, relatively flat copper bead approximately 0.08 inches in diameter was trapped between two fins opposite to the electrical connectors and approximately 1.2 inches in from the batteries edge. The copper bead was identified as Exhibit 1-10598. This resolidified copper bead had a neck-down appearance, which could indicate that the bead had been displaced from the end of an arced wire.

A piece of aluminum (Exhibit 1-5460), which was recovered separately, had resolidified into an elongated and distinctive shape that fit in the space between the fins on the top of a battery pack. The longest leg was approximately 2.1 inches long, the second was 0.9 inches, and the third was 0.02 inches with a small amount of aluminum on top of the two shortest legs. It was determined that the material was consistent with aluminum alloy 2024. It was further determined that this piece of aluminum had been trapped within the fins of the battery pack prior to impact and had subsequently become dislodged.

Flight Crew Reading Lights (Map Lights)

Description

Map Light Wire Routing

Power to the captain's and first officer's map lights, briefcase, and chart holder lights and the left and right observer's lights is provided by CB E-12 located on the 28 V DC Bus 2 in the lower main CB panel. The power wires were routed from the lower main CB panel to terminal strip S3-512 located in the avionics compartment. From S3-512, three wires were routed under the cockpit floor to the briefcase and chart holder lights. Four other wires were routed in wire run ABC up the right side of the fuselage to the overhead disconnect panel, to plug P1-442, located behind the upper avionics CB panel in the cockpit. The four wires were then routed from receptacle R5-422& (which mated with P1-442) in wire run AMJ/AMK into the right side of the overhead switch panel housing and continued in wire run AMK, AML, BZC, or BZB inside the housing. The power wire for the captain's map light is in wire run AML; it was routed through, and out of the left oval hole in the overhead switch panel housing. The power wire for the left observer's map light is in wire run BZB, which was routed through this same hole. The power wires for the first officer's and right observer's map lights are routed out of the right oval hole in the overhead switch panel housing.

Examination

First Officer's Map Light

The first officer's map light was still attached to a part of the ceiling liner.

(See photograph of "First officer's map light.")

Based on the orientation of the slot in the cockpit ceiling liner at the cutout for the map light assembly, it was determined that this map light was from the right side. The liner was crushed around the broken carrier frame, but the frame remained attached to the liner by screws and nutplates. The metal parts of the light fixture were lightly corroded from immersion in sea water. The carrier frame was fractured, but the light bulb housing that contained the reflector and the lamp was intact. The lamp's glass envelope remained intact, but the filament was fractured into several pieces. It was determined that the filament had been off or cold when fractured. The inner edge of the frame exhibited no evidence of electrical arcing damage. The positive metal spring contact to the base of the light bulb was intact with no evidence of electrical arcing. A three-inch length of 22 AWG polyimide wire remained attached by a ring terminal covered by an insulating sleeve to a terminal stud. The MAPRC insulation topcoat was scraped off in various locations, likely as a result of impact; however, the polyimide film underneath was intact and there was no evidence of any heat or soot damage.

The opposite side of this terminal stud was covered by an orange, rubber-like insulating cap. The cap was still pliable and did not exhibit any heat or soot damage. There was a small split in this cap, the area where arcing, from contact with the U-shaped bracket, had previously been reported. The nut under the cap exhibited no evidence that arcing had occurred between the stud and the bracket. The second terminal connection, adjacent to the terminal with the polyimide wire, was not found. The two white wires connected to the microswitch were both covered with clear sleeving, which exhibited no evidence of soot accumulation.

The cockpit ceiling liner around the fixture exhibited some soot accumulation, but the liner material had not softened. Two ball cups, which cover the front of the map light fixtures, were recovered. Based on their physical deformation, evidence of sooting, and the fact that the right observer's ball cup was captured in its housing, it was determined that these ball cups belonged to either the captain's or first officer's map light.

Right Observer's Map Light

The right observer's map light was installed in an aluminum housing in the horizontal panel located above the right observer's desk, below the lower avionics CB panel at STA 350.

The aluminum housing was crushed and parts of the light fixture were trapped in the housing.

(See photograph of "Right observer's map light.")

The green primer on the outer surface of the aluminum housing exhibited some soot accumulation, but was not heat damaged. The map light's ball cup, reflector housing, internal wires, and the carrier frame and associated brackets were trapped in the housing. The light bulb and plastic portion of the light socket, including the light socket input terminals and lamp base socket, were not identified. The light head portion of the map light assembly had separated and was not identified. The carrier frame was deformed and did not exhibit any evidence of arcing damage. One orange, rubber-like insulating cap, installed on one input terminal, was visible and was trapped within the crushed aluminum housing. Short lengths of a white and red wire were visible; the white wire exhibited a mechanical fracture, but no evidence of arcing damage.

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

Oxygen Systems

  1. Passenger Oxygen
    1. Description
      1. Oxygen Generators
      2. Electrical Circuitry to Release Module Door Latches
    2. Examination
    3. Determination
  2. Crew Oxygen
    1. Examination
      1. Oxygen Supply Lines
      2. Oxygen Cylinder
  3. Portable Oxygen
    1. Description
    2. Examination
    3. Determination

Passenger Oxygen

Description

The passenger oxygen system installed on HB-IWF consisted of 148 independently mounted chemical oxygen generators. The generators were manufactured by Scott Aviation (Scott) and consisted of 47 two-person generators (PN 801386, Series -82), 81 three-person generators (PN 801386, Series -83) and 20 four-person generators (PN 801386, Series -84).

The chemical generators and oxygen masks were mounted in oxygen box assemblies in the overhead stowage locations in the passenger cabin, the attendants' consoles, and the lavatories in the following numbers:

Table: Number and Location of Oxygen Box Assemblies

  Type of Generator
Location Two-Person Three-Person Four-Person
Passenger cabin 16 81 20
Lavatories 9    
Flight attendant station 12    
Skybunk area   3  
Crew rest area 7    

Each oxygen box contains one chemical oxygen generator that supplies oxygen to two, three, or four passengers for a minimum of 15 minutes.

Module doors provide access to the oxygen masks and generators. The doors are held closed by electrically operated bayonet latches that release when energized. The doors are automatically opened through an aneroid switch if the cabin pressure climbs above approximately 14 400 feet. If the doors fail to open automatically, a NO MASKS warning light on the air system panel in the cockpit will illuminate. The flight crew can select the doors open by pressing the NO MASKS push button on the air system panel. The doors can be opened manually, for maintenance purposes, by pressing on the latch lever with a sharp probe.

Once an oxygen generator has activated, the thermal decomposition of the generator core continues until the core is consumed. Each passenger oxygen mask is fitted with a reservoir bag that is attached to the oxygen generator with a flexible hose. When a generator is initiated, the reservoir bag unfolds and may inflate (depending on the altitude) until breathing begins.

Oxygen Generators

The Scott series 801386 oxygen generator cores are housed within a nickel shield and a stainless steel case. The three- and four-person generators are fitted with an additional internal copper shield. Once activated, the nickel shield will quickly discolour from exposure to heat. The cylindrical core in all models is insulated with a granular and pad-type insulation in order to maintain the external case temperature below the normal operating temperature of approximately 500°F.

The oxygen generators are actuated by pulling a lanyard pin, which releases a spring-driven striker against a percussion cap. A pull force of from 1 to 6 1/2 lb is required to disengage the lanyard. The generators burn a mixture of sodium chlorate and iron to produce oxygen and are designed to produce an increased flow of oxygen near the beginning of the burn sequence. During the 15 minutes of decomposition, the two-person oxygen generator will produce a minimum of 42 L of oxygen, the three-person generator will produce a minimum of 62 L of oxygen, and the four-person generator will produce a minimum of 84 L of oxygen. The maximum operating pressure is 40 psig for the first 30 seconds of activation and 35 psig for the duration of the burn.

An oxygen generator may also be activated by exposure to heat. According to the manufacturer, the core material has to reach 700°F before activation takes place. For example, if the generator was placed in an oven at 700°F, it could take up to an hour for an auto-reaction to take place.

The generators have a calendar life of 12 years. These generators are not fitted with an external indicator to identify whether the generator has been activated, and are considered unserviceable if the percussion cap has been struck by the hammer and the percussion cap is dented.

Electrical Circuitry to Release Module Door Latches

Power to release the door latches is provided through primary and secondary relays. The secondary relay is automatically activated after a short delay. Power to the primary relay is provided by the 28 V DC Generator Bus 3 through CB "PASS OXY CTL PRI" located in the upper main CB panel at Row K-04. The secondary relay is powered by the 28 V DC Generator Bus 1 through CB "CREW OXY QTY IND/PASS OXY CTL SEC" located in the upper main CB panel at Row J-05. The door latches in turn are powered from 115 V AC generator buses 2 and 3 (phase A). Activation of the aneroid switch completes a circuit to ground for the "PASS OXY EJECT CTL" relay powered from the 28 V DC Generator Bus 1 through CB "PASS OXY CTL MASTER" located on the upper avionics CB panel at C-04.

Examination

The 118 recovered oxygen generators had all sustained moderate to severe impact damage, and none retained the lanyard pin. The core material in several ruptured generators had been flushed as a result of water immersion. None of the recovered oxygen generators displayed evidence of exposure to external heat or soot. One generator was recovered in a green oxygen box. The outer surface of this box appeared to be sooted. Although the percussion cap was fired, the generator had not activated.

Scott Aviation provided five 801386-series oxygen generators for comparative analysis. These generators were activated (as follows) and cut open to allow examination of the shield(s).

  1. Test Sample 1 was a new three-person generator that had not been fired. All of the components were in a new, bright condition.
    (See photograph of "Exhibit 1-7318.")
  2. Test Sample 2 was a three-person generator that had been discharged under 15 cm of fresh water. Less than 6 cm of the 14 cm nickel shield was discoloured as a result of heat stress, and the copper shield was bright. The generators had to be held under water for these tests or they would have floated.
    (See photograph of "Exhibit 1-7319.")
  3. Test Sample 3 was a three-person generator that had been fired and discharged in a normal air environment. Almost the entire length of the 14 cm nickel shield was discoloured as a result of heat stress, and the copper shield was dulled.
    (See photograph of "Exhibit 1-7317.")
  4. Test Sample 4 was a two-person generator that had been fired and discharged in a normal air environment. Approximately 10 cm of the 13 cm nickel shield was discoloured as a result of heat stress.
    (See photograph of "Exhibit 1-7416.")
  5. Test Sample 5 was a two-person generator that had been discharged under 15 cm of fresh water. Less than 4 cm of the nickel heat shield was discoloured as a result of heat stress.
    (See photograph of "Exhibit 1-7415.")

The following criteria were used to evaluate whether the percussion cap been had fired and whether the core had initiated:

  1. The end of the percussion cap was examined for evidence of a hammer strike. Typically, the hammer strike leaves a dent in the centre of the cap. Caps that had been struck were visually examined for evidence of an atypical strike consisting of a shallow, off-centre, or double hammer strike. An atypical strike would likely be a result of impact with the water, after the hammer's hinge bracket had been squeezed or bent.
  2. The percussion cap tube was examined for evidence of discolouration and corrosion. The absence of either discolouration or corrosion at the tube would be evidence that the percussion cap had not fired.
  3. The dome at the head end of the core was visually examined for light grey "flash" material, the presence of which would be evidence that the flash material had not been initiated.
  4. The dome at the head end of the core was visually examined for evidence of heat stress. The presence of heat discolouration would be evidence that the cap had fired and the core had initiated.
  5. The wall of the nickel shield was examined for discolouration (blueing) from heat stress. The presence of blueing would indicate that the core had initiated and thermally decomposed. The length of the discoloured area of the wall was compared to samples provided by Scott Aviation to determine whether the generator had decomposed in an air or a water environment.

Of the 118 recovered oxygen generators, 83 were dismantled to allow the nickel shields on the two-person generators, and the nickel and copper shields on the three-person generators to be compared to the test samples. Based on the above criteria, 55 generators had initiated and likely decomposed underwater; 28 generators had not initiated, although the percussion caps of 10 of these had fired.

The shields of the 55 generators that had initiated all resembled those of the exemplars that were activated and immediately placed under water.

Determination

Except for the one oxygen box that appeared to have been sooted, there was no evidence on the 118 recovered generators to show that they were exposed to an external heat source or had contributed to the on-board fire.

Based on the oxygen generator examination, approximately 66% were activated by the percussion cap, while the remaining ones failed to activate. This would be an extremely low percentage for activation, had the generators been deployed in flight by the crew. It is assumed that if the masks had been dropped, the passengers would have used them. There was no evidence from the CVR recording to suggest that the passenger oxygen system was activated during the descent from 33 000 feet.

Those oxygen generators that were decomposed were considered to have been activated as a result of impact forces, when the oxygen generators disengaged from the lanyard-mounted striker retaining pins.

Crew Oxygen

Examination

Oxygen Supply Lines

Because of the routing of the crew oxygen supply lines through a fire-damaged area above the cockpit ceiling, the oxygen lines were examined to see whether a breach in the lines could have contributed to the propagation of the on-board fire. The following oxygen lines were recovered and examined:

Exhibit 1-12554 is a 13-inch long section of tubing (3/8-inch OD, 0.016-inch thick). This tube was flattened over 8 inches and had an overall soot-like appearance. This exhibit came from Exhibit 1-9954. One inch from an end were the remains of a thermoclad insulating red material used on the oxygen tubing. Both ends of the tube were fractured. The exhibit was identified as CRES 21-6-9 steel.

Exhibit 1-12546 is a 24.5-inch long section of tubing (3/8-inch OD, 0.016-inch thick). The remains of a red enamel coating thermoclad insulating material were located in various places along the tube. Both ends were fractured. One inch from one fractured end was an S492449-6S union. This type of union is used in three locations in the 3/8-inch OD tubing running from the oxygen bottle to the transition to 1/4-inch OD tubing, just to the right of the aircraft centreline, in the cockpit, between STA 383 and STA 374. There was no evidence of any heat distress on this tube.

Exhibit 1-12547 is a 14-inch long section of tubing (3/8-inch OD, 0.016-inch thick). Remains of a reddish paint was observed over the tubing surface. It was noted that the paint could be easily scraped off with a finger nail. Both ends were fractured. The remains of a green oxygen tag were located approximately one inch from a fractured end. There was no evidence of any heat distress on this tube.

Exhibit 1-12548 is a 34.5-inch long section of tubing (3/8-inch OD, 0.016-inch thick). Both ends were fractured. A union 6 1/4 inch from one end joined two pieces of tube. The tube had red enamel paint remaining in numerous places along the length of the tube. This tube was originally attached to an instrument air tube located in the avionics compartment. There was no evidence of any heat distress on this tube.

Exhibit 1-12550 is a 22-inch long section of tubing (1/4-inch OD, 0.016-inch thick). Both ends were fractured. The tube had red enamel paint remaining on it, from end to end. There was no evidence of any heat distress on this tube.

Exhibit 1-7747 is a 10¾-inch long section of tubing (1/4-inch OD, 0.016-inch thick). This tube had red enamel paint on it. There was no evidence of any heat distress on this tube.

Exhibit 1-12549 (from 1-9954) is a 4 1/2-inch long section of tubing (1/4-inch OD, 0.016-inch thick). Both ends were fractured. This tube had red enamel paint on it. There was no evidence of any heat distress on this tube.

Exhibit 1-7748 is a 17-inch long section of tubing (5/16-inch OD, 0.035-inch thick). The tubing had the green primer on it and the remains of a tag. The tag had the following on it: "Breathing Oxygen," "Crew Oxygen," and the PN ABM7005-615. There was no evidence of any heat distress on this tube. The tube was determined to have been attached to the oxygen cylinder located in the avionics compartment.

Exhibit 1-11822 is a 6 3/4-inch long section of tubing (1/4-inch OD, 0.016-inch thick). Both ends were fractured. The remains of a tag were affixed to the tube, with "Breathing Oxygen" written on it. The red enamel paint, which appeared under the tag, could be peeled off the tube easily. The remainder of the tube was bare of any paint. This 1/4-inch line had been located in the avionics compartment and down the right side of the aircraft.

Oxygen Cylinder

The oxygen cylinder was examined visually and physically. The internal metal shell had been ripped apart and was held together by the para-aramid fiber jacket only. (See photograph of "Exhibit 1-1623.") To assist examination of the fracture surfaces, the para-aramid fiber jacket was removed from one half of the metal shell. (See photograph of "Crew oxygen cylinder, lower half.")

The fracture path observed on the interior shell was predominantly circumferential, with a pronounced shear lip. The shell was considerably deformed (flattened). The deformation and the orientation of the fracture path was similar to that from containers that were tested to failure. The most likely failure scenario was a rupture, caused by a sudden reduction in volume, from crushing, and the resulting pressure build up. The physical features of the ruptured shell were consistent with the failure of the cylinder under pressure.

Portable Oxygen

Description

First aid and cabin crew oxygen was stored in twelve 310 L oxygen cylinders, located at various points in the passenger cabin. Four 120 L portable oxygen cylinders, with masks, were also stowed in the passenger cabin. (See illustration of "Emergency equipment locations.")

Examination

Three (of four) 120 L portable oxygen cylinders were recovered, as were eight (of twelve) 310 L cylinders. Visual examination revealed no evidence of heat damage.

The following information was collected during visual examination of the recovered oxygen cylinders:

  1. 310 L (11 cubic feet) Scott portable.
    (See photograph of "Exhibit 1-7626.")
    Regulator detached, cylinder wall dented, contains sea water. Threaded portion of fractured regulator nipple retained in cylinder neck. Swissair control tag 9700CIA. Weight 2 435 grams. Stamps on shoulder: 3AA-1800, C02454P, 12-80+*.
  2. 310 L (11 cubic feet) Scott portable.
    (See photograph of "Exhibit 1-14.")
    Regulator detached, one dent in sidewall. Threaded portion of fractured regulator nipple retained in cylinder neck. Strap attached, one end secured with band clamp. PN ??BF23B,[1] manufacturing date 7/87, 0B50087-36, hydro date 3/87+*. Weight 2370 grams. Stamps on shoulder: DOT-3AA-1800, L 586575 Pst.
  3. 310 L (11 cubic feet) Scott portable.
    (See photograph of "Exhibit 1-7627.")
    Regulator detached, small dent in wall near bottom. Threaded portion of fractured regulator nipple retained in cylinder neck. Swissair tag IDN 7.08810, ASN 0.385, PN 9700-??3523P, Scott model ?970 series, Boeing 87/??, manufacturing date ?0/03, hydro date 8/93+*. Weight 2285 grams. Stamps on shoulder: DOT-3AA-1800, 397971 Pst.
  4. 310 L (11 cubic feet) Scott portable.
    (See photograph of "Exhibit 1-7628.")
    Regulator detached, one dent near bottom. Threaded portion of fractured regulator nipple retained in cylinder neck. Swissair tag IDN 7.08810, ASN not legible, PN 9700-C1A-?, Boeing PN 60B50087, manufacturing date 10/93, hydro date 8/93+*. Weight 2 315 grams. Canadian Forces partial conditioning tag duct-taped to cylinder (post-recovery). Stamps on shoulder: DOT-3AA-1800, C397969 Pst.
  5. 310 L (11 cubic feet) Scott portable.
    (See photograph of "Exhibit 1-7632.")
    Regulator attached, on-off control knob detached, thread end of cylinder damaged. Valve in closed position. Small piece of magnetic material on cylinder wall. Cylinder discharged, contained sea water, regulator removed and sea water emptied. Hydro date 9/92+* (stamped on shoulder). Weight 3 050 grams (after dumping sea water). Stamps on shoulder: DOT-3AA-1800, C46376 Pst, 2(A2)(21)98.
  6. 310 L (11 cubic feet) Scott portable.
    (See photograph of "Exhibit 1-7633.")
    Regulator attached, valve bent, on-off knob detached, four ports exposed on head, minor damage to cylinder. Valve in open position. Strap secured to bottom of cylinder with clamp. Cylinder empty. Hydro date 5/90+* (stamped on shoulder). Weight 3 120 grams. Stamps on shoulder: DOT-3AA-1800, 026527 Pst.
  7. 310 L (11 cubic feet) Scott portable.
    (See photograph of "Exhibit 1-7634.")
    Regulator attached and damaged, three valve ports open. Swissair tag 9700C1ABF23B, Swissair tag IDN 708810, ASN 0179. Valve closed, cylinder empty. Piece of Canadian Forces material condition tag attached, torn portion of tag says "empty"(may have been discharged for safety reasons). Weight 2 600 grams. Stamps on shoulder: DOT-3AA-1800, 9.92, 94456DN, AWK, AUERSTOFF, Swissair, 9 SR 97*, 02026, 1212K70+, LG.2.07kg.FD.127BAR, V.2.53LT.PD.211BAR.
  8. 310 L (11 cubic feet) Scott portable.
    (See photograph of "Exhibit 1-7635.")
    Regulator attached, gauge detached, two ports open owing to damage, cylinder dented near bottom of wall. Valve closed, contained sea water, regulator removed and sea water dumped. Swissair tag 970021A5F20B, PN 9700-C1A-F20D. Weight 3 280 grams. Stamps on shoulder: ICC-3AA2100, K-1932, SCOTT, 8 (B9) (04), 89*06, 60194, 11(cam)78, 12056*, 2 66, 5664.
  9. 120 L (4.25 cubic feet) Scott portable.
    (See photograph of "Exhibit 1-7629.")
    Regulator detached, one large dent in wall near neck. Threaded portion of fractured regulator nipple retained in cylinder neck. Decal "For Crew Use Only." Hydro date 12/91+* (stamp). Weight 1 360 grams. Stamps on shoulder: DOT-3AA-1800, C151649 Pst.
  10. 120 L (4.25 cubic feet) Scott portable.
    (See photograph of "Exhibit 1-7631.")
    Regulator attached, gauge attached, needle detached, strap attached. Valve in closed position. Cylinder displays no significant damage. Swissair control tag SK??6805, 9700-A1A-BF23BV-SR, PN 9?0-A1A-BF23B. Cylinder was still charged. Manufacturing date 8/90, hydro date 2/90+* (stamp). Weight 2 300 grams. Stamps on shoulder: DOT-3AA-1800, 960482 Pst.
  11. 120 L (4.25 cubic feet) Scott portable.
    (See photograph of "Exhibit 1-7630.")
    Regulator attached, shaft for on-off control knob bent, strap attached to neck. Valve in closed position. Decal "For Crew Use Only." Valve/regulator damaged, cylinder shows no significant damage. Cylinder empty when examined; however, it may have been discharged by recovery personnel as a safety precaution. Swissair control tag SN 36814, 9700-A1A-BF23BV-SR, PN 9700-A1A?? Weight 2 195 grams. Stamps on shoulder: DOT-3AA-1800, 960556 Pst.
  12. Detached Scott oxygen regulator.
    (See photograph of "Exhibit 1-7636.")
    Nipple fractured. PN 80H6010, SN 3229. On-off control knob detached, valved jammed, position unknown.
  13. Detached Scott oxygen regulator.
    (See photograph of "Exhibit 1-7637.")
    On-off control knob attached. Valve in open position. Ink stamps A4Q93, PT30.
  14. Detached Scott oxygen regulator.
    (See photograph of "Exhibit 1-7638.")
    Nipple fractured, PN 801160-03. Gauge attached, no needle. On-off control knob detached, valve jammed, position unknown.
  15. Detached Scott oxygen regulator.
    (See photograph of "Exhibit 1-7639.")
    Nipple fractured, gauge detached, three ports open, on-off control knob detached, valve open.
  16. Detached Scott oxygen regulator.
    (See photograph of "Exhibit 1-7640.")
    On-off knob attached, gauge detached, two ports open owing to damage. Regulator has been unthreaded from a cylinder. Valve in open position.

Determination

Of the 16 portable oxygen cylinders, 11 were recovered. Unfortunately, during the initial recovery phase some of the oxygen cylinders may have been discharged as a safety precaution before they could be examined by TSB personnel. However, it is likely that at least three of the cylinders were still charged when recovered; another three had damaged regulators and were empty; the remaining five were missing their regulators. Of the five detached regulators that were recovered, three were in the open position and the position of the other two was unknown. One of the open detached regulators appeared to have been unscrewed from a cylinder and may have been opened by recovery personnel to discharge the cylinder. The two remaining open detached regulators had their on-off knobs broken away and likely were open at the time of impact.


[1]   Question marks (?) are used to indicate identification numbers or letters that are illegible.

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

Performance

  1. Aircraft Behaviour and Track after the Recorders Stopped
  2. Impact
    1. Impact Damage
      1. ADG Fuselage Frame and Door
      2. Avionics Bay Door
      3. Throttle Quadrant
      4. Standby Compass
      5. Standby Gyro
      6. Cockpit Windows
      7. Angle of Attack Vane
      8. Engine Pylon Attachment Fittings
    2. Impact Speed
    3. Impact Determination
  3. Theoretical Emergency Descent Profile
  4. Landing Performance

Aircraft Behaviour and Track after the Recorders Stopped

The final 5 1/2 minutes of the SR 111 flight were not captured by the flight recorders, as fire-related system damage caused the recorders to stop prematurely. However, secondary radar data from several sources were available for the entire flight, including the diversion to Halifax and most of the final 5 1/2 minutes.[1] Data recovered from the FADEC NVM from engines 2 and 3 also provided useful information for the final minutes of the flight.

To characterize the final minutes of the flight, the NTSB Vehicle Performance Division made an initial radar data study using the Halifax radar data. Although several radar sites captured parts of the latter portion of the flight, the Halifax radar gave the most complete data, with primary returns down to 600 feet above the ocean. The altitude floor of radar depends on line-of-sight, and the Halifax radar site is only about 38 nm from the crash site. At about 53 nm distant, the Greenwood military site was the next closest site, but data from that location was of a lower resolution and was not used in the analysis of radar data.

The Halifax data showed that transponder Mode C altitude information was temporarily lost at 0125:11, approximately 30 seconds before the flight recorder stopped.[2] Given the 4.82-second sweep rate, it is possible that the loss of Mode C occurred as much as 4.82 seconds earlier. The Mode C altitude information was regained between 0125:45 and 0125:50, and indicated a constant pressure altitude of 9 700 feet over the next four samples. The Mode C was subsequently lost for the final time between 0126:04 and 0126:09. Primary radar returns were recorded for the next five minutes after the final Mode C loss, with the final primary radar return recorded at 0131:08.[3] The impact with the ocean occurred 10 seconds later, at approximately 0131:18, based on seismic information.

The radar data was studied with the DANTE computer program, developed at the NTSB. This program takes inputs of radar position data, wind information, and aircraft weight and aerodynamic coefficients and calculates several flight and performance parameters, including pitch, roll, and yaw angles, altitude, ground speed, true airspeed, track angle, drift angle, flight path angle, angle of attack, and load factor. The wind information used in this analysis was based on the 0000 UTC weather balloon data from Yarmouth, Nova Scotia, recorded on 3 September 1998. An aircraft gross weight of approximately 230 tonnes was assumed for the study. Radar inaccuracies in the measurement of time, range, and azimuth information typically result in unrealistic oscillations or discontinuities in the ground track, and this characteristic is generally even more apparent with primary radar data. Thus, the derivatives calculated from radar position tend to be erratic as well. For this reason, the radar data were smoothed to attenuate the oscillations in the calculated derivatives. Since the process of smoothing can eliminate realistic peaks in the data, the calculated performance parameters may be suspect in certain areas. For example, the calculated bank angle ranged between 0 and 40 degrees during the final right-hand descending turn; however, the calculation shows an increase to approximately 50 degrees of right bank for the final few primary radar returns. It cannot be confirmed whether this calculation is accurate or reflects excessive smoothing of the radar returns, which artificially increased the radius of curvature of the ground track in that area of the flight.

The results of the radar study showed that there was generally good agreement between the radar-derived parameters and FDR data, up to the time the flight recorder stopped. For example, speed differences were found to be within 3%. The study also suggested that there were no sudden changes in the aircraft's behaviour or trajectory that would indicate a dramatic event between the time of the last transponder Mode C return at 9 700 feet and the last primary radar return as low as 600 feet above the ocean. The performance calculations suggested that the angle of attack remained well below the stall angle, and bank angles remained below 40 degrees.

The precise altitude profile during the final descent from 9 700 feet was not known. Based on the elapsed time between the last transponder Mode C return at 9 700 feet and the crash, it was possible to calculate an average rate of descent consistent with the spacing of the radar returns, the site of the impact, and the estimated time of impact. Based on the above assumptions, the radar study showed that it was possible for the aircraft to have flown from 9 700 feet to the point of impact at an average rate of descent of approximately 1 800 fpm. The calculations also showed a ground speed varying between 230 and 370 knots, and bank angles ranging between 0 and 40 degrees right. The average ground speed for the last 5 1/2 minutes of flight was calculated to be approximately 285 knots. Based on the assumed altitude profile, the calculated pitch angle varied between -3 and 3 degrees during the descending right turns. This suggests that the aircraft was in relatively stable flight in a right descending turn down to about 600 feet.

Fault information normally used for engine maintenance purposes was recorded by each engine's FADEC. Each recorded fault had an associated time delay between fault occurrence and the time it was written in NVM. Each recorded fault also contained additional information, including N2, Pamb, M, and pressure altitude, sampled at the time the fault was written into NVM. Since the FADEC data was not synchronized with any standard time references, the fault timing had to be synchronized with FDR data, using recorded N2 and Pamb.

No faults were recorded until the aircraft had descended to 10 000 feet. While some of the faults were recorded when the FDR was still operational, many were written to NVM after the flight recorders had stopped. Consequently, the precise time of most of the faults is not known. The manufacturer of the engine analyzed the data and found that engines 2 and 3 lost FCC-1 inputs between 0125:05 and 0125:07; this is consistent with the FDR information. No faults were recorded by the Engine 3 FADEC below 10 000 feet. Engine 2 recorded some faults, possibly between 10 000 and 2 000 feet. Engine 2 also recorded a fault corresponding to a FADEC reset, at a pressure altitude of 1 782 feet. The reset was consistent with an Engine 2 shutdown via the fuel condition switch, with subsequent faults indicating a decay in N2 down to windmilling speed. Given the tolerance of ± 470 feet on the recorded pressure altitude, and assuming a sea level pressure of 29.80 inches, the reset occurred between approximately 1 300 and 2 300 feet above the ocean. A rough estimate of the time of the Engine 2 shutdown, using the altitude profile developed for the flight animation, was approximately 45 seconds to one minute before impact, based on an average descent rate of 1 800 fpm.

Impact

Impact Damage

The debris field was small. If the aircraft had broken up while skipping across the surface of the water, the debris field would have been larger. The concentrated location of the wreckage and the severity of the damage suggest that the aircraft did not enter the water at a glancing attitude. In a crash into water at a sufficient speed to shatter an aircraft, as in this case, the heaviest parts travel farthest along the wreckage path. Heavy items originally on the fuselage reference line tend to stay on that line; light items tend to drift with the current.

During examination of the wreckage, it was often noted that the impact force appeared to have been at an angle of 15 degrees to the right of the fuselage centerline. This is indicative of descent into the water in an uncoordinated right bank. The damage to the right horizontal stabilizer is consistent with the impact forces having been more severe on the right than on the left. In addition, both wing engine mounts failed instantaneously in overstress. The Engine 3 mount experienced a significant clockwise torque loading; that is, the cross-beam that slips over the lug tended to twist clockwise when viewed aft to forward. By contrast, the Engine 1 mount lug broke off with less indication of a clockwise torque load. The principal loading to cause the separation would likely be upward bending of the lug.

ADG Fuselage Frame and Door

The door through which the ADG drops is between fuselage stations STA 555 and STA 575. The opening is about 20 inches by 11 inches, with semicircular ends 11 inches in diameter. The long edges parallel the fuselage centerline. The door hinge is on the outboard long edge. The door is swung open by its linkage to the ADG. The ADG is mechanically released from the cockpit, which allows a pressurized snubber to force it into the deployed position.

Wreckage of the ADG door frame was recovered. From this wreckage it appears that the door frame was "dished in" from the bottom and crushed aft to create major folds at an angle of 15 to 25 degrees to the longitudinal axis of the door frame and, therefore, to the fuselage. This is consistent with the impact having been at 15 degrees to the right of the fuselage centerline.

Avionics Bay Door

The trap door from the cockpit into the avionics bay was crushed into buckles, starting at its right front corner and oriented 15 degrees to the fuselage centreline.

Throttle Quadrant

The throttle quadrant pedestal was crushed and twisted about 15 degrees clockwise about its vertical axis.

Standby Compass

The standby compass has an almost perfect witness-mark crease in its upper right corner, which matches the left edge of the centre bar of the cockpit windshield frame at its upper end where it starts to curve. This crease also suggests an impact angle 15 degrees to the right of the fuselage centerline.

Standby Gyro

The standby gyro horizon, which is almost on the centerline of the aircraft, was crushed in at the upper right corner, and has buckles oriented 15 to 20 degrees to the fuselage centreline.

Cockpit Windows

The right cockpit window was slightly more damaged than the left window. This is consistent with it facing more to the front, with an impact at 15 degrees to the right of the fuselage centerline.

Angle of Attack Vane

The angle of attack vane on the left side of the aircraft was bent 22 degrees downward relative to the fuselage reference line (and now has 32 degrees of anhedral). Taken in isolation, this tends to support a relatively low angle of impact with the water and the view that the aircraft did not crash inverted. The premise for this theory is that the aircraft, on entering the water at an acute angle, tends to plough, as it meets greater resistance to motion downward than forward. The angle of attack vane then streamlines under the water-exerted force, moving the vane arm to a positive angle-of-attack position and bending the vane wingtip down into anhedral. Had the aircraft entered the water inverted at an acute angle, the vane wingtip might now be displaying dihedral. It is not possible to say what effects shielding had on the water flow in the area and, therefore, whether this view is accurate.

Engine Pylon Attachment Fittings

The fittings that attach the engine pylons to the front spars were both bent aft and twisted clockwise (looking down). The fitting associated with the left engine was bent aft to a greater extent, but the structure adjacent to the right fitting was more damaged.

Impact Speed

The last three primary radar hits occurred at the following UTC times and aircraft coordinates:

0130:58.2 44°25'41.9" N 63°57'55.9" W
0131:03.0 44°25'21.6" N 63°57'53.8" W
0131:07.8 44°24'58.4" N 63°57'54.7" W

The scan rate for the radar was one revolution every 4.82 seconds. According to seismographic information, the aircraft hit the water at 0131:17.6. The impact time of 0131:17.6 ± 0.5 seconds was based on a wreckage position given as

  • 44°24.561' N 63°58.425' W
    (which becomes 44°24'33.6" N 63°58'25.5" W)

The aircraft wreckage field was centred about 2 511 feet south and 2 228 feet west of the last radar hit.

The configuration at impact was determined to be wheels up, flaps 15 degrees, and slats retracted. The stall speeds chart from the AOM indicates, for this configuration, the following stall speeds:

Table: Stall Speeds

Aircraft Weight 215 t 230 t
Level Flight Stall Speed 160 kt 166 kt
60° Banked Turn Stall Speed 226 kt 235 kt

An analysis of the aircraft's acceleration capabilities suggests that it probably did not overspeed to a structurally damaging extent. The average velocity over the aircraft's last seven radar hits was 264 knots. (The radar tabular print-out reports an airspeed of 240 knots for the last three primary radar hits, and 250 knots for the 10 hits before that; however, these speeds do not correlate particularly well with the changes in radar-established position.) Even in a vertical dive (which did not happen) from 1 100 feet at 264 knots there would be less than 2.5 seconds in which to accelerate before impact. This would lead to a lower impact velocity than an accelerated slant descent. Engine 2 was shut down within about one minute before the end of the flight, according to analysis of the Engine 2 FADEC. Engine 3 appears to have gone to near-idle. Conservatively assuming a take-off thrust for the remaining engine and a slant descent from 1 100 feet beginning at 264 knots at the last radar hit, the structural limit speed for the aircraft (350 knots IAS) would not have been exceeded.

Impact Determination

The aircraft did not accelerate to a structurally damaging airspeed before it hit the water. Calculations suggest that it would be aerodynamically feasible for the aircraft to turn from its final radar heading to the crash site in the time available. The turn would have been steep.

A high-impact speed is suggested by the following factors:

  • the extent of structural break-up, with many small pieces from the nose area and only a few moderately large pieces from well aft;
  • the completeness of the breakup, with nothing escaping severe damage;
  • the absence of any intact seats, windshield frames, or door frames; and
  • the severe damage to all undercarriage, including the splitting of the nose gear cylinder by the compression of its oleo leg.

Some structural evidence points to an impact of about 15 degrees to the right of the aircraft centerline. A descending right turn would account for this and would explain the disparities in damage between the right and left engines and engine mounts.

Theoretical Emergency Descent Profile

The theoretical emergency descent profile was developed using data from a simulation carried out by the aircraft manufacturer. The simulator profile was flown in a motion-based engineering simulator using the FAA-approved emergency descent checklist procedures for the MD-11. The profile did not take into account wind or any changes in aircraft weight or C of G that may have resulted from fuel dumping. The initial conditions were as follows:

Gross weight 507 700 lb
C of G .313% MAC
Flaps retracted to 0 degrees
Landing gear retracted
Throttles idle
Speed brakes fully extended
IAS increased to maximum operating speed[4]

The simulated profile included a speed reduction from maximum operating speed to 270 KIAS while levelling off at approximately 10 000 feet to extend the landing gear. The descent was then re-initiated with a further reduction in speed. In descent through approximately 6 000 feet, the speed brakes were retracted and Flap 15 was selected. This was followed by a further levelling off at 3 000 feet with subsequent Flap 35 selection. Final descent was initiated with approach speed maintained at approximately 170 KIAS.

Actual wind information from the FDR was combined with engineering simulator data to calculate the aircraft's ground speed during the emergency descent and the earliest possible landing time. This ground speed was then mathematically integrated to derive displacement (or distance travelled over time). The upper winds were recorded once every 64 seconds based on inertial reference system information. These winds were derived to a higher resolution of once per second using recorded ground speed, drift, computed airspeed, and magnetic heading. The winds were then derived as a function of pressure altitude to determine the ground speed along the emergency descent vertical profile. Given the recorded winds, the ground speed attained was dependent on the track flown toward the Halifax airport, which in turn depended on where along the flight path the emergency descent profile would be initiated.

It was assumed that the track flown to the airport was the simplest possible, with the least lateral manoeuvring. Consequently, the profile assumed direct tracking to the GOLF NDB from the point of initiation, followed by a straight-in segment from the beacon to the threshold of Runway 06. To simplify the calculations, the time and distance for the turns (less than 20-degree turns) were ignored. By mathematically integrating the ground speed for the straight-in segment from the beacon to the runway, and considering the known distance of 4.9 nm from the beacon to the threshold, a beacon crossing time was estimated for the emergency descent.

For any point along the flight path, the displacement based on the derived ground speed between the time of initiation and the time of beacon crossing could be compared against the distance to the GOLF beacon based on the recorded inertial position from the aircraft's on-board inertial reference system. It was presumed that there would be only one point along the aircraft's flight path where the inertial distance to the GOLF beacon would be equivalent to the distance travelled along the emergency descent profile over the specified period. Initiation of the emergency descent at this time would result in the earliest possible landing with the least amount of lateral manoeuvring. Several iterations of this calculation were required to determine the geographical position and associated time.

The emergency descent profile intersects the accident flight profile at about 0114:18. This represents the optimal point at which to initiate a descent for the earliest possible landing without having to manoeuvre to lose altitude. It is coincidental that the theoretical best time to initiate a descent to land in the shortest time is only a few seconds after the Pan Pan call was made. An earlier descent farther away from the airport would have been premature and would have taken longer than the ideal theoretical descent point. Descending later (closer to the airport), meant that manoeuvring would have been required to lose altitude. It is noteworthy that the optimal time for an emergency descent into Halifax was more than a minute prior to the decision to accept Halifax as the preferred airport. Decisions regarding the time and rate of descent would have been influenced by the cues available to the flight crew.

The simulated emergency descent performed by the manufacturer's simulator indicated that it would have taken approximately 13 minutes and 8 seconds to descend from FL330 down to a landing and complete stop. It should be noted that the time to descend was independent of the wind conditions, which have an effect only on the distance required to descend. The simulator database did not contain Halifax airport; therefore, a different airport was used—one that had a field elevation of 15 feet (462 feet lower than that of the Halifax airport). The simulated data were adjusted for use in the above calculation, to approximate descent to the Halifax airport. With this adjustment, the time from FL330 to a runway threshold crossing height of 50 feet agl was approximately 12 minutes. This time segment was used in the mathematical integration. The earliest estimated threshold crossing time was, therefore, 0126:17. This was considered to be an approximate time because of the limitations of the analysis, as described above.

Landing Performance

The landing distance data must include correction factors for wind, aircraft landing weight, airport elevation, and runway surface conditions. The influence of temperature, barometric pressure, and runway slope on the landing distance of the MD-11 is not accounted for, since it is small enough to be covered by the operational reserve (40% of the available runway length remaining).

The elevation of Halifax International Airport is 477 feet. Runway 06 is asphalt-covered, with an average slope of less than 0.08%, down, and has an available runway length 8 800 feet. The runway was dry.

At 0121, the flight crew of SR 111 indicated that the aircraft weight was 230 tonnes. The recommended maximum landing weight of the MD-11 is 199.58 tonnes; however, an overweight landing up to 218.4 tonnes is permitted under certain conditions. The AOM states that "no overweight landings are authorized if one of the following conditions exist":

  • There is a tire failure;
  • The runway is contaminated;
  • There is a crosswind of over 20 knots;
  • The slats are inoperative;
  • There are split flaps;
  • The hydraulics system is unserviceable;
  • There are flight control troubles;
  • There is a jammed stabilizer;
  • The anti-skid is unserviceable;
  • The reverser is unserviceable; or
  • Two engines are inoperative.

The AOM further states that "in case of a declared emergency the PIC may take any action deemed necessary, i.e., disregard the limitations/restrictions stipulated above."

Using runway and atmospheric conditions at 0135 at Halifax International Airport, the landing distance requirement for a serviceable MD-11 on Runway 06 (or Runway 24) was calculated as follows. (According to the regulations, an aircraft should be capable of stopping within 60% of the required runway length.)

Table: Required Runway Length

Aircraft Weight Flaps 35 Degrees Landing Flaps 50 Degrees Landing
  Runway 06 Runway 24 Runway 06 Runway 24
199.58 t 7 875 ft. 8 630 ft. 7 060 ft. 7 800 ft.
218.40 t 8 530 ft. 9 310 ft. 7 875 ft. 8 575 ft.
230.00 t 8 860 ft. 9 660 ft. 8 200 ft. 9 000 ft.

[1]    Secondary radar is a system in which radar pulses transmitted from a transmitter/receiver (interrogator) site are received in cooperative equipment installed in the aircraft in the form of a radio receiver/transmitter (transponder). The transponder is used to trigger a distinctive reply transmission, rather than a reflected signal, back to the interrogator site for processing and display at an air traffic control facility.

[2]    Mode C is a specific pulse spacing of radio signals transmitted or received by the interrogator site that permits altitude reporting of the aircraft's transponder to the nearest hundred feet.

[3]    Primary radar is a system in which a minute portion of a radio pulse transmitted from a site is reflected by an object and then received back at that site for processing and display at an air traffic control facility.

[4]    Maximum operating Mach is constant at Mach 0.87. This translates to a maximum operating speed of approximately 312 KIAS at FL330. As the aircraft descends, maximum operating speed increases to 365 KIAS at FL260, and then remains at 365 KIAS.

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

Powerplants

  1. Powerplants
    1. Description
      1. HMU
      2. FADEC
      3. Bleed Valves
      4. Operating Limitations
      5. SVAs
      6. Engine-Driven Hydraulic Pumps
      7. Thrust Reverser System
    2. Examination
    3. Determination
  2. Engine 1
    1. Description
    2. Examination
      1. Fan/LPC
      2. High-Pressure Compressor
      3. Diffuser/Combustor
      4. High-Pressure Turbine/Low-Pressure Turbine
      5. Borescope Examination
      6. Engine 1 Mounts
      7. Engine 1 FADEC
      8. Engine 1 SCU
      9. Engine 1 Throttle Lever Angle
      10. Engine 1 HMU
      11. Engine 1 FMU
      12. Engine 1 SVA
      13. Hydraulic Pump 1A
      14. Hydraulic Pump 1B
    3. Determination
  3. Engine 2
    1. Description
    2. Examination
      1. Fan/Low-Pressure Compressor
      2. High-Pressure Compressor
      3. Diffuser/Combustor
      4. High-Pressure Turbine/Low-Pressure Turbine
      5. Borescope Examination
      6. Engine 2 Mounts
      7. Engine 2 FADEC
      8. Engine 2 SCU
      9. Engine 2 Throttle Lever Angle
      10. Engine 2 HMU
      11. Engine 2 FMU
      12. Engine 2 SVA
      13. Hydraulic Pump 2A
      14. Hydraulic Pump 2B
    3. Determination
  4. Engine 3
    1. Description
    2. Examination
      1. Fan/LPC
      2. High-Pressure Compressor
      3. Diffuser/Combustor
      4. High-Pressure Turbine/Low-Pressure Turbine
      5. Borescope Examination
      6. Engine 3 Mounts
      7. Engine 3 FADEC
      8. Engine 3 SCU
      9. Engine 3 Throttle Lever Angle
      10. Engine 3 HMU
      11. Engine 3 FMU
      12. Engine 3 SVA
      13. Hydraulic Pump 3A
      14. Hydraulic Pump 3B
    3. Determination
  5. Bleed Valves
    1. 2.5 Bleed Valve Actuators – Engines 1 and 3
      1. Description
      2. Examination
    2. 2.5 Bleed Valve Actuator – Engine 2
      1. Description
      2. Examination
    3. 2.9 Bleed Valves
      1. Examination
  6. Permanent Magnet Alternators
    1. Examination
    2. Determination
  7. Thrust Reverser Actuators
    1. Examination
    2. Determination
  8. Auxiliary Power Unit
    1. Description
    2. Examination
      1. APU Electronic Control Unit
    3. Determination
  9. Engine Fuel Analysis
    1. Examination
    2. Determination

Powerplants

Description

The MD-11 aircraft is equipped with three Pratt & Whitney model 4462 engines, one on each wing and one in the vertical stabilizer.[1] The model 4462 engine is a two-spool axial flow turbofan engine of high compression and bypass ratio with a maximum thrust of 62 000 lb. It has 16 compressor stages, an annular combustion chamber and six turbine stages. The low-pressure section is composed of a 5-stage LPC driven by a 4-stage LPT mechanically isolated from the high-pressure system. The high-pressure system has an 11-stage HPC driven by a 2-stage HPT.

The engine case consists of the fan case (which contains the fan and low-pressure compressor), the intermediate case, the high-pressure compressor case, the diffuser and combustion case, the high-pressure turbine case, the low-pressure turbine case, and the turbine exhaust case. These cases comprise the main support structure for the engine, with the internal parts and components being supported by struts and bearings.

The LPC supplies two air flows. The first stage of the LPC, the "N1 fan," is much larger in diameter than the other 15 compressor stages and provides the secondary (outer) airflow that is ducted outside the engine to give approximately 80% of the engine's propulsive force. The primary (inner) airflow is directed through the engine gaspath, compressed, and ignited, resulting in expanding gases that drive the fan and compressors and produce the remaining 20% of the propulsive force.

The engine installation uses a two-point, fail-safe mount linkage system to attach the engines to the wing pylons and vertical fin base structure. These mounts support the engines and transmit thrust and torque loads from the engines to the aircraft structure.

The mount system for engines 1 and 3 includes the following components:

  • Forward mount, located on the rear face of the intermediate case flange at the 12 o'clock position
  • Aft mount, located on the turbine exhaust case flange between the 11 and 1 o'clock positions

The mount system for Engine 2 includes the following components:

  • Forward mount, located on the rear face of the intermediate case flange at the 12 o'clock position
  • Aft mount, located on the turbine exhaust case flange between the 11 and 1 o'clock positions
  • Side mount, attached to the rear spar bulkhead and the engine bellmouth

HMU

The HMU is a component of the fuel and control system. It is composed of the fuel/oil cooler and bypass valve, the fuel pump and fuel filter, and the fuel metering unit. The fuel and control system performs thrust management and fuel scheduling/metering for all engine operating conditions. It also provides automatic fuel heating and oil cooling, selected component and systems control, and required interfaces with aircraft systems. The fuel flows from the aircraft fuel tanks to the fuel pump boost stage inlet. From the boost pump the fuel flows to the fuel/oil cooler and is then returned to the pump where it is filtered and sent to the main stage. The main stage discharge fuel flows to the FMU, which provides metered fuel through the fuel flow transmitter to the distribution valve and onward through the manifolds to the injectors in the combustion chamber. Servo interface fuel flows are also provided by the FMUs. The FADEC receives aircraft and engine information to schedule fuel flow via an electronic interface with the FMU.

FADEC

The PW4462 electronic engine control system is a dual-channel FADEC that interfaces with aircraft and engine control components and sensors. The FADEC provides basic engine control functions, condition monitoring for maintenance, and on-board diagnostics and fault detection/storage in NVM that is also used for maintenance purposes.

The FADEC's two electronic channels (A and B) each incorporate a processor, power supply, program memory, selected input sensors, and output drive circuitry. Each channel is independently capable of controlling the operation of the engine. Each channel of the FADEC is electrically powered by a dual-output PMA installed on the respective engine's accessory gear box. The PMA also provides the rotational speed of the HPC or N2 speed, to the FADEC. The FADEC can also be powered by aircraft-supplied 28 V DC. In the accident aircraft, the 28 V DC aircraft power was supplied via an optional SCU with a backup power option. The 115 V AC aircraft power was used to power the engines' inlet Pt2/Tt2 probe heaters.

During normal operations, the FADEC uses all the above-mentioned aircraft-supplied inputs, but is not dependent on this information to ensure safe engine operation. The FADEC contains logic to detect problems with the aircraft-supplied inputs and, if necessary, continues operation based solely on engine-supplied information and electrical power.

There are three digital data buses from the aircraft to each of the two FADEC channels. Two of the buses supply data from the ADCs and the other supplies data from the FCC. FCC-1 provides data to Channel A and FCC-2 provides data to Channel B. The FCCs provide EPR trim, engine service bleed extractions, aircraft on-ground indications, flaps/slats retracted information, and ARINC 429 data from ADC-1 and ADC-2. The ADCs provide pressure altitude, Pt2, and Tt2 to channels A and B.

The FADEC also receives inputs from the engine throttle resolvers located below the central pedestal on the throttle levers. There is a dual-throttle resolver per thrust lever. The dual resolver contains two resolvers in one package driven by a single, common shaft. One resolver provides TRA input to Channel A and the second to Channel B. The FADEC provides electrical excitation for the resolvers.

The FADEC ARINC input processing operates in two modes: the primary sampling mode and the secondary sampling mode. In the primary sampling mode, all of the aircraft data are received from the FCCs. This allows the FADEC to receive the EPR trim signal at the necessary high-update rate. If one FCC bus fails, the FADEC will remain in the primary sampling mode, receiving FCC input by cross-talk from the other FADEC channel. If the FCC inputs are no longer available, the FADEC will switch to the secondary sampling mode. The control will switch to the secondary mode if there is a loss of EPR trim input for 10 seconds, if there are 7 minor outages of 250 ms each, if the total pressure cannot be confirmed when the probe heat is indicated as being off, or if the altitude cannot be confirmed when the left and right ADC agree within a set tolerance.

In the secondary sampling mode, the FADEC sequentially monitors ADC-1, the FCC, ADC-2, and the FADEC transmitter wrap around.[2] The FADEC waits until all of the data are received from each bus or until the maximum sampling time (250 ms and 550 ms for the FCC and ADC buses, respectively) has elapsed before proceeding to the next bus, which might take up to 1.4 seconds. Because of the length of time required to process the data in the secondary sampling mode, the FCC EPR trim signal is set to zero once the FADEC switches to the secondary sampling mode. The FCC EPR trim signal, therefore, has no effect on the calculation of the EPR command. Other valid inputs from the FCC will be used in the secondary sampling mode.

The thrust management system for the PW4462 is provided in the dual-channel FADEC. The FADEC commands the FMU to set the engine fuel flow as required to establish direct control of the EPR, the prime thrust setting parameter. In the EPR mode, the commanded EPR is calculated in the FADEC as a function of the TRA, altitude, Pt2, M, and Tt2; the flight crew can select the service bleed and anti-ice EPR resets.

When the FADEC detects failures that prevent it from controlling the thrust in the EPR mode, it will automatically switch to an alternate mode of operation. Depending on the cause of the alternate mode selection, the FADEC will switch into one of two alternate modes: the soft reversionary mode or the hard reversionary mode. This switch to the reversionary mode will cause the autothrottle system to disconnect, if it was engaged.

When the FADEC detects failures affecting the rating or the EPR calculations, it switches to the soft reversionary mode to accommodate the failure. This results in a switch from EPR control to N1 control, with a down-trim to the TRA-versus-N1 schedule used to schedule thrust in the alternate mode. The down-trim is used to prevent a change in thrust when switching from the EPR mode to the alternate mode. This down-trim will remain in effect until the flight crew removes it using the FADEC MODE switch. The engine may be thrust-limited (with the down-trim in effect) if the ambient conditions have changed since the FADEC switched to the soft reversionary mode. The crew is not required to take any immediate action when this switch occurs, as the down-trim ensures that the engine will not increase or decrease thrust during the transition from EPR to N1 mode. The alternate mode schedules N1 as a function of thrust lever position; therefore, the crew is still able to control thrust through the throttles.

The hard reversionary mode may be initiated at any time by the flight crew by selecting the appropriate FADEC MODE SELECT switch located on the FADEC MODE panel on the overhead panel. This mode may also be selected by pushing the throttle beyond the normal forward stop position. This hard reversionary mode is the same as the soft reversionary mode except that no down-trim is applied to the TRA-versus-N1 schedule. As the soft and hard reversionary modes are non-rated modes, there is no rating protection available. In the hard reversionary mode, the N1 redline is commanded at maximum throttle. The N1 and N2 redline is always protected and is not affected by the inability to calculate ratings.

If the FADEC switches to the soft reversionary mode, the amber FADEC MODE switch, SELECT and ALTN lights will illuminate and an amber SELECT FADEC ALTN alert will be displayed on the EAD DU. DU 3 normally displays the EAD information. The flight crew can select the hard reversionary mode by pushing the illuminated SELECT ALTN switch. According to the procedures, the throttles must be retarded prior to selecting the hard reversionary mode.

If reversion to the N1 mode occurs, it is possible to attempt to reselect the EPR mode by first reducing the thrust on the affected engine (to 70% N1 or less) and then selecting the FADEC MODE switch twice. With the first selection, the alternate control mode is manually selected, the SELECT light is extinguished, and the ALTN light stays illuminated. A second selection of the same switch may re-select the primary control mode. If the SELECT light does not illuminate and the ALTN light extinguishes, the system has reverted to the EPR mode. If the primary mode is not successfully recovered, it is recommended that all engines be placed in the alternate control mode to avoid throttle stagger and differences in throttle response.

When the FUEL switch is placed in the cutoff position, the FADEC senses a switch closure (one per FADEC channel) and reinitializes to insure proper operation when the engine is restarted. When the switch closes, the volatile fault memory (all latched faults) is cleared, but the NVM is not. Reinitialization lasts approximately 1.2 seconds and performs the following functions: reset of the overspeed latch, reset of latched faults, channel synchronization, and a timer check. As the FADEC receives its primary power from the PMA for critical control functions, a loss of aircraft power will not lead to an external reset.

Each FADEC channel contains 192 cells of NVM that record fault information to improve engine maintenance scheduling and troubleshooting. The fault data are stored sequentially, with Fault 193 overwriting Cell 1. Each fault records five, 16-bit data words per cell that contain the fault code number and the following parametric data: FADEC elapsed operating time, N2 speed, aircraft M, Pt2, FADEC cold junction temperature, and FADEC flight or ground leg number. The fault data are stored when the faults are written into NVM and are recorded only once per flight leg.

The time at which the faults are latched to memory is not synchronized with aircraft time. As the FADEC records the engine run time in 20-minute increments, it is difficult to correlate the time a fault was written to memory with UTC. The data values written to NVM are based on engine measurements and FADEC calculations at the time the fault was written to memory, rather than when the fault occurred. The faults are not necessarily written to the NVM in the order of occurrence. Each fault has a unique pre-determined time delay between the time the fault occurred and the time it is latched. This delay is based on the nature of the fault and its relationship to other faults that may have occurred. Faults are stored in a three-word buffer that is cleared once per second. The buffer is emptied in reverse; that is, the first fault received is the last fault written to the buffer when faults are latched within the same second. There are also artificial default values that are output with certain types of faults.

Bleed Valves

The 2.5 bleed air subsystem increases compressor stability during starting, transient, and reverse thrust operation. The 2.5 bleed valve is connected to an actuator through a bellcrank and, when open, releases fourth-stage LPC air into the fan airstream. It is controlled by the FADEC as a function of TRA, N1, N2, Tt2, M, and altitude. During an engine start, the valve is commanded fully open and will begin to close at approximately 70% N2. If a surge is detected on an engine, the valve is commanded fully open. This valve is also fully open during reverse thrust operations on the wing engines but only half open on the tail engine.

The 2.9 bleed valves, located at the ninth-stage HPC, improves compressor stability during starting and transient operation. The FADEC controls the left 2.9 stability bleed valve as a function of corrected N2, altitude, and time and controls the right 2.9 start bleed valve as a function of corrected N2. During an engine start, both valves are open. At approximately 2% N2c2 below idle speed, both valves close. If the FADEC detects a surge at any time, the left valve opens. The left valve also opens for up to 180 seconds if the engine is decelerated below approximately 81% N2 and the altitude is between approximately 16 000 and 20 000 feet; it closes upon acceleration. The valves are spring-loaded open and commanded closed by the FADEC.

Operating Limitations

The following operating limits apply to the PW4462 engine:

  • 100% N1 = 3 600 rpm
  • redline N1 = 111.4% or 4 012 rpm
  • 100% N2 = 9 900 rpm
  • redline N2 = 105.5% or 10 450 rpm
  • maximum thrust = 62 000 lb

SVAs

The VSV control subsystem provides maximum compressor performance by moving the HPC inlet guide vanes and fifth-, sixth-, and seventh-stage vanes to their programmed positions in response to commands from the FADEC. The VSV control subsystem also improves engine starting properties. During an engine start, the VSVs may be open until approximately 15% N2, at which time they would close. At speeds above approximately 40% N2, the VSVs modulate to open with increasing N1 and N2 and are fully open at take-off and climb power. The vanes modulate with N1, N2, and Tt2 changes.

Engine-Driven Hydraulic Pumps

The main hydraulic power system has three divided systems, each identified by the engine that supplies it with power. The three hydraulic systems are pressurized to 3 000 psi by engine-driven variable-displacement, piston-type pumps. There are two pumps on each engine—one on the left front and one on the right rear of the accessory drive gear box. Although each system has two engine-driven pumps, one pump will provide enough continuous, non-pulsating flow for normal system operation. During system operation, the left pump is selected on and the right pump is armed. The armed pump is depressurized and feathered, and hydraulic pressure is maintained at a reduced rate to lubricate and cool the pump until it is selected on, either manually or automatically. Each pump can provide 37.5 gpm (142 L/min) at 3 000 psi.

The operator maintained a record of the PNs, SNs, flying hours, engine cycles, calendar days installed, and total calendar days of the pumps installed on each engine, but did not record the installation position. This is consistent with industry practice for modern aircraft. Although the PNs and SNs are entered in the component inventory, operator-assigned IDNs and ASNs are used to track the components. These numbers are stamped into an adhesive metallized tag applied to the component case. When the hydraulic pumps were recovered the metallized tags were still attached to the pump cases.

The pumps are numbered according to the engine on which they are installed; the A and B identifiers (e.g.,Pump 1A) were assigned for documentation and report-writing purposes only; they do not indicate whether the pump was installed in the left or right position on the engine gearbox.

Thrust Reverser System

When selected by the flight crew, the thrust reverser system decelerates the aircraft on the ground by reversing the direction of the engine thrust. This reduces the length of runway needed to safely and efficiently stop during a landing or a rejected take-off. The aircraft thrust reverser system consists of the following major components: 3 HCUs (1 per engine), 6 upper feedback (non-locking) actuators (2 per engine), 12 centre and lower locking actuators (4 per engine), flexible synchronizing shafts, translating sleeves, blocker doors, thrust-reverser cascades, and electrical harnesses. Of these components, 3 HCUs, 10 locking actuators, and 6 non-locking actuators were recovered and examined (along with 2 rod pieces).

Examination

In some respects, the three engines were recovered in similar condition upon recovery. The fan, HPC, diffuser/burner, HPT, and LPT modules remained joined; the LPC modules were not recovered. The remaining case structures showed no evidence of uncontained internal failures. The fan blade containment rings were recovered intact; however, the fan case, fan exit guide vane case, and outer diameter of the intermediate case were recovered in pieces. As these pieces were retrieved from the accident site, they were examined and assessed in relation to their original installed positions. The amount of external components, hardware, and pylons that remained attached to the engines varied. The three engines showed signs of corrosion consistent with salt water immersion. Various fragments and parts of nacelles, LPC, engine build-up components, and other parts from all three engine positions were recovered from the crash site.

Engine positions were verified by comparing engine module SNs with Swissair maintenance records. Engine 2 was readily identified, as it was recovered with part of its distinctive pylon attached.

The throttle quadrant was recovered and was severely damaged. It had been struck on the upper-right, forward corner, as viewed from the rear, and was crushed and distorted to the left. The three throttles were fractured from the throttle pivot shaft, but remained in the quadrant, attached only by the reverser linkages.

FADEC 2 (SN 4000-0991) and FADEC 3 (SN 4000-1620) were recovered, separated from their respective engines. FADEC 3 exhibited heavier impact damage than FADEC 2. Only a few of the circuit boards from FADEC 1 (SN 4000-0672) were recovered. The EEPROM chips, which constitute the FADEC NVM, were not recovered. The FADECs were returned to the manufacturer, United Technologies, Hamilton Sundstrand Division, for fault data extraction. The FADECs were preserved in de-ionized water until they were examined.

Owing to damage to the Channel A EEPROMs from each engine, no useful data could be recovered. The Channel B EEPROMs from both engines were successfully downloaded and fault data were recovered from the accident flight. Review of the fault data showed that FADEC 2 recorded 20 faults and FADEC 3 recorded 10 faults during the last flight leg. There were no faults written to Engine 3 for the previous six flights and none for Engine 2 for the previous 171 flights. The 10 faults recorded on Engine 3 were also among the first 11 faults recorded on Engine 2.

Determination

The detailed examination of the engines revealed no anomalies that would have prevented normal operation. The lack of a penetration violation of the fan containment rings and engine cases indicated there had been no pre-impact liberation of the internal rotating components. There was no indication of metal impingement on the internal components, indicating that there had been no internal failures in any of the engines' gaspaths.

None of the six engine-driven pumps exhibited anomalies that would have prevented normal operation. Based on the rotational scoring, it was determined that the pumps were being driven by their respective gearboxes at the time of impact; however, it could not be determined which pumps were producing pressure and which were armed.

Analysis indicated that at the time of impact, Engine 1 was producing high power, Engine 3 was producing a lower power than Engine 1, and Engine 2 was shut down.

Engine 1

Description

Table: Engine 1 Identification

Manufacturer Pratt & Whitney, East Hartford, Connecticut, USA
Model PW4462-3CN
SN P723896CN
Date of Manufacture 2 June 1992
Total Time 27 659 flight hours
Total Cycles 4 566 cycles
Installation Date 30 April 1998
Time Since Test 1 906 flight hours
Cycles Since Test 276 cycles
Total Time Limit 14 104 cycles
Total Time to Go 9 538 cycles

Examination

(See photograph of "Engine 1 - top view.")

Fan/LPC

The fan containment ring was intact, distorted, and displaced to the rear of the engine. Several sections of the fan blade rub strip were missing. There were no impact marks on the ring's inner diameter that would indicate a strike by a liberated fan blade. The remainder of the fan case and fan exit guide vane case were not recovered.

The fan hub was recovered intact and the fan blade root attachments were in the blade slots. One blade was fractured inboard of the attachment platform and the remaining blades were fractured above the blade attachment platform. Ten blades retained portions of airfoil, ranging from approximately 6 to 12 inches in length. The features of the fracture surfaces were consistent with overload failure, with no visible evidence of fatigue. The fan rotor was displaced rearward off the LPC/LPT coupling splines; the splines exhibited localized blueing, smearing, and metal transfer. The splines on the inner bore of the fan hub also exhibited blueing, smearing, and metal transfer. Both sets of splines were smeared in the direction opposite to rotation.

The LPC module was fractured. Portions of the Bearing 1 inner race and bearing cage remained on the LPT shaft. No pre-impact distress was noted on the inner race. The fan exit guide vane case had broken away. The inner diameter of the intermediate case remained with the engine and the leading edges of the inner diameter struts exhibited evidence of gouging, rotational scoring, and smearing. (See Arrow A in photograph of the "Inner diameter struts.")

High-Pressure Compressor

The HPC case was fractured at a plane aft of the IGVs. The IGVs were not recovered. The fifth-stage HPC blades were fractured above the root platform and the fracture surfaces were smeared in a direction opposite to rotation. The fifth-stage VSVs and 15 of the sixth-stage VSVs were not recovered. The remaining sixth-stage VSVs were at various angles and exhibited gouging to the leading edges. An arc of about 45 degrees of the seventh-stage VSVs was fractured above the root platform. The eighth-stage VSVs were also captured at various angles and exhibited leading edge damage. The remaining blades did not exhibit any impingement resulting from metal spray that would indicate a failure of a component upstream in the gaspath. The remaining eighth-stage VSVs and blades downstream were not visible. The VSV unison rings and the VSV actuator remained attached to the engine. The remainder of the HPC case was intact, with some buckling noted in the area of the 2.9 bleed valves.

Diffuser/Combustor

The diffuser/combustor case was fractured from the 8 o'clock position to the 2 o'clock position. The fuel injectors were recovered with the engine; 19 of the 24 injectors were removed and their leading edges were examined. No impingement resulting from metal spray was noted. The injectors exhibited impact damage and were contaminated with dirt, debris, and corrosion to the extent that meaningful testing was not possible.

High-Pressure Turbine/Low-Pressure Turbine

The HPT and LPT cases were recovered intact but exhibited some buckling. The exhaust plug was crushed inward over the Bearing 4 housing and the exhaust nozzle was crushed from left to right over the exhaust plug. The LPT case cooling tubes remained attached to the engines but exhibited some inward crushing. The fifth- and sixth-stage turbine (third- and fourth-stage LPT) blades were fractured above the root platform and the fifth and sixth turbine vane segments were damaged, dislodged, or both. The trailing edges of the fourth-stage turbine vanes were damaged. The fifth- and sixth-stage turbine outer airseal honeycomb was rubbed out.

(See photograph of the "Turbine blade airseal.")

The four Pt4.95/Tt4.95 exhaust probes remained in their installed locations and were undamaged. The turbine exhaust case struts were undamaged. The rears of the main Bearing 4 rollers displayed no deformation, but the bearing had been pushed aft, fracturing the retaining flange.

Borescope Examination

Several clock locations and stages of the HPC, combustion chamber, and leading edges of the first-stage HPT blades were examined using a borescope. Numerous broken blades and blades with tip smearing were observed, along with post-impact debris. No impingement resulting from metal spray was noted on the components.

Engine 1 Mounts

The forward engine mount was still installed on the engine. The bolt that attaches the engine mount to the intermediate case was fractured at the first thread below the radius. The engine mount had fractured where the mount lug enters the mount crossbeam. The mount was submitted to the Material Analysis Division of the TSB for failure analysis. It was determined that the mount lug failed instantaneously in bending overload in an upward direction. In contrast to the Engine 3 mount, this mount failed with less indication of a clockwise torque load.

The aft engine mount was found installed on the engine. The forward attachment flange of the aft engine mount was bent forward and down on the left side. The rear attachment flange was bent aft, giving the appearance that the mount had twisted forward on the left side and aft on the right side.

Engine 1 FADEC

Electronic circuit boards from the Engine 1 FADEC were recovered; however, the EEPROM chips containing the NVM were not recovered. As a result, no recorded FADEC information was retrieved that might have revealed the operational status of Engine 1 at the time of impact. Some of the faults that were recorded on FADEC 2 and FADEC 3 would also likely have been recorded on FADEC 1. The resulting effect on the engine would have been similar.

Engine 1 SCU

The SCU from Engine 1 was recovered; however, since the NVM chip was not recovered, no information was retrieved.

Engine 1 Throttle Lever Angle

The throttle was found in the throttle quadrant, displaced toward the left side, fractured free of the throttle pivot shaft but attached to the thrust reverser linkage. This displacement caused the throttle to contact the throttle quadrant, resulting in impact marks on the throttle shaft.

(See photograph of "Engine 1 throttle.")

These impact marks were aligned and the position of the throttle relative to full throttle position was measured. The measurements were forwarded to the manufacturer of the aircraft, where they were interpreted into TRAs and thrust levels. One calculation assumed that the engine was operating in the primary EPR mode of control while a second calculation assumed the engine was operating in the manually selected hard reversionary N1 mode. The thrust levels in the EPR mode are the lowest possible thrust levels that each engine would produce for the given TRAs.

Calculated thrust levels, using an ambient temperature of 15°C, for Engine 1 operating in the primary EPR mode of engine control, are presented in the table below. According to the engine manufacturer, these calculated thrust values are also considered to be closely representative of the engine operating in the soft reversionary N1 mode of control, assuming the throttle did not move once the engine entered the soft reversionary mode.

Table: Calculated Thrust Levels

Engine Mode TRA EPR Thrust
1 EPR 77.93 1.5778 45 960 lbf

If the aircrew had selected the hard reversionary N1 mode, then the downtrim would have been removed. The thrust level values for Engine 1 operating in the selected N1 mode, presented in the table below, were calculated using an ambient temperature of 15°C:

Table: Engine 1 Thrust Level in N1 Mode

Engine Mode TRA N1 Thrust
1 N1 77.93 111.8% 54 195 lbf

Engine 1 HMU

The fuel bypass valve of the Engine 1 HMU was fractured, the pump body exhibited impact damage, and the electrical connections on the FMU were missing. Disassembly and examination revealed the presence of fuel, and a fuel sample was secured. The fuel filter and filter housing were contaminated with sand and dirt. No internal components appeared to have suffered a pre-impact failure. Rotational scoring was observed on the impeller and on the inlet housing from the impeller and inducer.

(See photographs of "HMU impeller scoring" and "HMU inlet housing scoring.")

Engine 1 FMU

Table: Engine 1 FMU Identification

Manufacturer United Technologies
PN 801000-3
SN F31714
Model JFC131-2
Swissair IDN 473699
Swissair ASN 183
Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

SMOKE ELEC/AIR Selector

  1. SMOKE ELEC/AIR Selector Description
    1. SMOKE ELEC/AIR Selector Positions
  2. SMOKE ELEC/AIR Selector Examination
  3. SMOKE ELEC/AIR Selector Determination
    1. Influence of SMOKE ELEC/AIR Selector Position on Fuel Dumping
      1. Fuel Dump Initiated and SMOKE ELEC/AIR Selector Selected to 3/1 OFF Position
      2. SMOKE ELEC/AIR Selector in 3/1 OFF Position and Fuel Dump Stopped
      3. SMOKE ELEC/AIR Selector in 3/1 OFF Position and Fuel Dump Not Stopped
      4. SMOKE ELEC/AIR Selector in 3/1 OFF Position and Fuel Dump Started
    2. Potential Use of SMOKE ELEC/AIR Selector Causing Loss of Recorders
    3. Potential Use of SMOKE ELEC/AIR Selector after Loss of Recorders

SMOKE ELEC/AIR Selector Description

The SMOKE ELEC/AIR selector controls the electrical and air systems' isolation functions when the system is in auto or manual mode.

The switch is a rotary four-position push-to-turn design. The selector body consists of a four-gang stack of switch terminals identified as A, B, C, and D. The selector neck is threaded and designed with a slot to allow for the installation of a lock tab to align and position the selector in the panel. The threading of the neck allows for two nuts to be used (one on each side of the panel) to secure the selector to the panel. The shaft of the selector extends approximately half an inch beyond the threaded selector neck to allow for the installation of the selector knob. The shaft is designed with a machined flat (progressing through approximately one quarter of the diameter of the shaft) to allow for the alignment of the knob with the selector. The shaft flat is designed to face upward and aft when the selector is mounted in the panel and the knob is in the NORM position. The shaft is also designed with two additional machined undercut flats that progress from the centre outer circumference of the shaft to a Vee point opposite the flat (the Vee being at the 6 o'clock position when viewed directly from the back). The flats are undercut, in that they do not progress through to the end of the shaft as does the machined flat. The flats are designed such that two set screws, mounted in the knob, can be tightened against the shaft to secure the knob to the shaft.

(See photograph of "SMOKE ELEC/AIR selector.")

SMOKE ELEC/AIR Selector Positions

The selector has four positions: NORM, 3/1 OFF, 2/3 OFF, and 1/2 OFF. It must be pushed in and turned clockwise to move to the next position.

(See illustration of "SMOKE ELEC/AIR selector.")

SMOKE ELEC/AIR Selector Positions

Position Action
NORM All generator relays, auxiliary power relays, bus tie relays, and DC tie remote control CBs are in the normal auto or manual mode. The air system operation is normal.
3/1 OFF Generator System 3 is de-powered. ECON mode and Galley Bus 3 is unpowered. EIS cathode ray tubes go full bright. Pack 1 and Air Supply 1 turn off.
2/3 OFF Generator System 3 is again powered, Generator System 2 is de-powered. Galley Bus 3 is again powered and Galley Bus 2 is de-powered.
Pack 1 and Air Supply 1 are reinstated. Pack 3 and Air Supply 3 are turned off.
1/2 OFF Generator System 2 is again powered, Generator System 1 is de-powered. Galley Bus 2 is again powered and Galley Bus 1 is de-powered. Automatic transfer of emergency power is inhibited.
Pack 3 and Air Supply 3 are reinstated. Pack 2 and Air Supply 2 are turned off.
NORM Generator System 1 is again powered. The ECON capability of the air system returns and Galley Bus 1 returns to normal operation. EIS CRTs return to auto brightness control. Pack 2 and Air Supply 2 are reinstated.

SMOKE ELEC/AIR Selector Examination

Some of the remains of the SMOKE ELEC/AIR selector were recovered and examined, including the threaded shaft neck, the two mounting nuts, the lock tab and washer arrangement, and the switch base plate. Two indentations were noted in the threaded shaft neck and an exemplar selector was requested from the manufacturer for comparison. (The exemplar selector was received from Honeywell and was exhibited as 1-12817. A label on the selector identified it as being manufactured by Janco Corporation in Burbank, California, and rated at 5 A 115 V AC. The number 51-2006 (8743) was stamped on the body of the selector.)

The four-gang stack of selector terminals and the shaft had pulled free from the shaft neck and selector base plate and were not recovered. The selector base plate was bent and the two selector plate lug holes were torn open. The lip of the threaded shaft neck, when viewed directly from the back, had two gouge marks, one at the 3 o'clock and one at the 6 o'clock position, and had a rolled edge area between the 7 o'clock and 8 o'clock position.

(See photographs of "SMOKE ELEC/AIR selector - shaft neck" and "SMOKE ELEC/AIR selector - Vee area - alignment with gouge.")

SMOKE ELEC/AIR Selector Determination

The damage to the selector base plate and the two selector plate lug holes is consistent with the selector being subjected to a side load on the base of the selector. The rolled area on the lip of the threaded shaft neck is consistent with the shaft contacting the inner bore of the neck from the side or bending load placed on the selector. The two gouge marks matched the locations and dimensions of the corners of the machined undercut flats in the shaft. The Vee area of the shaft aligned with the gouge at the 6 o'clock position or with the knob in the NORM position. It was determined that the selector was in the NORM position at the time of impact.

Influence of SMOKE ELEC/AIR Selector Position
on Fuel Dumping

Fuel Dump Initiated and SMOKE ELEC/AIR Selector
Selected to 3/1 OFF Position

Fuel dumping is initiated through the FUEL DUMP switch on the fuel control panel located in the overhead switch panel. Activation of the switch turns on the fuel boost and transfer pumps and opens the cross-feed and dump valves, allowing fuel to dump equally through the left and right fuel dump valves. If the SMOKE ELEC/AIR selector is selected to the 3/1 OFF position (shutting down Generator 3 and the right emergency bus), the Tank 1 aft boost, Tank 2 transfer, Tank 2 left aft, Tank 3 forward boost, and the lower auxiliary right transfer pumps turn off and fuel dumping continues at a slightly lower discharge rate.

SMOKE ELEC/AIR Selector in 3/1 OFF Position and
Fuel Dump Stopped

If the FUEL DUMP switch is shut off with the selector in the 3/1 OFF position, the right dump valve and the Cross-Feed Valve 3 will not close, as they require power from Generator 3. In order to prevent further loss of fuel from Tank 3, the two remaining operating pumps (Tank 3 aft boost and Tank 3 transfer pumps) must be turned off. This results in Engine 3 being on suction feed.

If the fuel dump is stopped but the right dump valve is not closed and the Tank 3 pumps are not turned off, fuel will continue to be dumped from the right side at approximately 1 000 lb/min. A "DUMP VLV R DISAG" level 2 alert, a "FUEL XFEED 3 DISAG" level 1 alert, and an illuminated Tank 3 cross-feed disagree light on the overhead panel will result. If these indications are not acted upon, a structural load imbalance limit of 4 000 lb may occur. If this limit is reached, a "LAT FUEL UNBAL" level 2 alert will be displayed. If still no action is taken, the fuel level in Tank 3 will drop enough to cause the fuel pumps on the SD to flicker between green and amber and eventually go full amber, resulting in a "TANK 3 FWD PMP LO" level 2 alert, a "TANK 3 PUMPS LO" level 2 alert, a "TNK FUEL QTY LO" alert and the illumination of Tank 3 pumps' low light on the overhead panel. If still no action is taken, Tank 3 will run out of fuel and Engine 3 will shut down.

SMOKE ELEC/AIR Selector in 3/1 OFF Position and
Fuel Dump Not Stopped

If the fuel dump is not stopped, a "FUEL DUMP LEVEL" level 2 alert appears with the consequence "STOP FUEL DUMP." A level 3 alert "TNK FUEL QTY LO" with the consequence "STOP FUEL DUMP" appears with 8 000 to 9 000 lb of fuel remaining in Tank 3.

SMOKE ELEC/AIR Selector in 3/1 OFF Position and
Fuel Dump Started

If the fuel dump is started with the selector in the 3/1 OFF position, the right fuel dump valve and the Cross-Feed Valve 3 will not open. The alerts "DMP VLV R DISAG" and "FUEL XFEED 3 DISAG" will immediately appear. If no action is taken, after some time the structural lateral imbalance limits may be approached and the "LAT FUEL UNBAL" alert appears. If still no action is taken, the fuel level will become low enough that the low-level fuel dump shut-off system closes the three fuel cross-feed valves and the left fuel dump valve, terminating the fuel dump.

If the fuel dump was started after the SMOKE ELEC/AIR selector was positioned, the fuel dump is terminated at the low-level shut-off quantity, regardless of the position of the switch.

The fuel low-level shut-off circuits were revised to provide redundant power sources on fuselage 545 and subsequent fuselages. Fuselages prior to 545 could incorporate MD-11 SB 28-048. An AD in this regard was subsequently issued in May 1994 by the FAA. As a result of this revision, tanks 1 and 3 will shut off at their low-level quantity unless the SMOKE ELEC/AIR selector is in the 3/1 OFF or 1/2 OFF positions after the fuel dump has started. This prevents one of the dump valves from closing and prevents the tanks 1 or 3 cross-feed valves from closing. Flight crew intervention would be necessary to stop the flow of fuel out of the respective tanks.

If the Tank 2 cross-feed were open with the SMOKE ELEC/AIR selector in the 2/3 OFF position, it would continue to supply fuel to the dump valves. However, once the total usable fuel reaches 30 000 lb, the dump valves would automatically close and stop the fuel dump.

Potential Use of SMOKE ELEC/AIR Selector
Causing Loss of Recorders

Prior to the recorders stopping, the engine N2 values were steadily decreasing with the aircraft altitude around 10 300 feet. At 0125:40, approximately one second prior to the recorders stopping, the FDR recorded Engine 2 N2 at 6 049 rpm (61.1%) and Engine 3 N2 at 6 059 rpm (61.2%). The first faults (after the ST350X) written to FADEC 2 (STI) were N2 of 6 016 rpm (60.8%) and the first faults written to FADEC 3 (STI) were N2 of 6 016 rpm (60.8%). The closeness of the FDR N2 engine speeds and the FADEC-recorded N2 speeds make it appear that the faults written to the FADECs occurred shortly after the loss of the recorders.

The FDR is powered from 115 V AC Bus 3 and the CVR from the right emergency 115 V AC bus. Both buses in turn are powered from the main Generator Bus 3. Both recorders appeared to have stopped within 0.4 seconds of each other ± 1 second. The FADEC data was used to assess whether the SMOKE ELEC/AIR selector had been used by the crew. If the selector was used at 0125:41, Generator Bus 3 and all of its sub-buses would be de-powered. Of particular interest is that the Engine 3 probe heater, FCC-2, ADC-2, FADEC 3 28 V DC-3 backup power, and both recorders—all powered by Generator Bus 3—would be de-powered by this action at the same time and they were not.

During the time frame from 0125:06 to 0125:41 when the recorders went off-line, the FDR did not record any altitude and airspeed data. Air traffic services also did not record any ATC transponder altitude (Mode C) during this time frame, although the transponder identification code (Mode A) continued to be recorded. However, at 0125:49.6, altitude data was again recorded by ATC until 0126:04.1 reporting an altitude of 9 700 feet for all four recorded sweeps. It was Swissair's practice to use transponder ATC-1 on odd-numbered flights (SR 111), which obtains its primary air data from ADC-1. For ATC-1 to start sending Mode C altitude information either ADC-1 was recovered or the pilot had to switch the air data source to ADC-2. ADC-1 was powered from the left emergency 115 V AC bus. This bus was no longer powered because of an arcing event that occurred on that wire; therefore, the air data source had to have been switched to ADC-2 to recover ATC. This switching would have to take place within 8.5 seconds from the time the recorders went off-line to regain the Mode C. It was likely that the transponder, not the air data, was lost at 0126:04 as both mode A and C functions were lost.

Assuming the SMOKE ELEC/AIR selector was used at 0125:41 and caused the loss of the recorders and initiated the FADEC 2 and 3 faults, the ADC-2 fault would be written to NVM approximately 15 seconds later. This is based on the loss of FCC-2 taking 10 seconds to be written to NVM and then an additional 5 seconds for the FADEC to register the loss of ADC-2. These numbers are approximate as the faults are entered into a three-word buffer prior to being sent to NVM. Each word is written to NVM once per second; if more than one fault is written at a time it may take up to three seconds after the initial time delay to be entered into NVM. This means that ADC-2 would be off at 0125:58 and at least six seconds prior to this (0125:52) because the fault must be at least five seconds in duration before the FADEC writes it to NVM. Between 0125:49.6 and 0126:04.1, Mode C altitude was being recorded by ATC; therefore, ADC-2 had to have been operational. Therefore, the SMOKE ELEC/AIR selector was not turned to the 3/1 OFF position at 0125:41 and did not cause the loss of the recorders.

Potential Use of SMOKE ELEC/AIR Selector
after Loss of Recorders

The SMOKE ELEC/AIR selector was not believed to have been used at the time the recorders stopped. Because of the timing of two of the NVM faults from FADEC 3, the failure of particular systems, and the lack of a credible fire scenario to have caused these two faults, it was considered that the SMOKE ELEC/AIR selector was turned to the 3/1 OFF position at some time after the recorders were stopped. The selector could not have been turned before this time as the recorders would have stopped recording sooner. The first five faults after ST350X on FADEC 3, starting with the PHEATF to the RADCF, were all written at the same N2 of 6 016 rpm. The recorded altitudes varied from a high of 10 314 feet to 9 787 feet. However, given the tolerance of ± 470 feet, the recorded altitudes were most likely recorded around the 10 000-foot level. The ATS recorded altitude was 9 700 feet during the four sweeps that Mode C returned.

Using the SMOKE ELEC/AIR selector (3/1 OFF position) would cause FCC-2 and ADC-2 to shut down simultaneously. The loss of FCC-2 and ADC-2 were the third and fourth faults recorded on FADEC 2. However, the RADCF fault on FADEC 2 was recorded at a higher N2 (6 656 rpm) than the FCCF (6 016 rpm) fault on FADEC 3. At this time FADEC 3 would have switched to the alternate N1 mode; however, until the probe heat fails on FADEC 2 it is still in EPR mode with autothrottles disconnected. The alternate N1 mode uses a down trimmed N1 schedule to ensure a "bumpless" transfer from EPR to N1 mode. The down trim may explain the lag of Engine 3 in terms of N2 speed but by the time the CASHUN fault is written in FADEC 3, the N2 speed is at 6 912 rpm; that is, within 20 seconds of the loss of the probe heater.

If the crew used the SMOKE ELEC/AIR selector, at the 3/1 OFF position and assuming that DU 2 was still functional, the air data would be lost until the selector is turned to the next position (2/3 OFF). At this position, the FADEC 2 probe heat would be lost (28 V DC-2) and FCC-2 and ADC-2 could possibly come back online; however, there is no way of proving this from the data. It would be logical for the crew to go the next position (2/3 OFF) to regain air data and to have also completed the cycle back to the NORM position. There is evidence from motors and fans that all three generator buses were powered at the time of impact suggesting that the SMOKE ELEC/AIR selector was in the NORM position.

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

Standby Flight Instruments

  1. Standby Attitude Indicator
    1. Description
    2. Examination
    3. Determination
  2. Standby Airspeed Indicator/Altimeter
    1. Description
    2. Examination
    3. Determination
  3. Standby Instrument Lighting
    1. Description
    2. Examination
    3. Determination
  4. Standby Compass Lighting
    1. Description
    2. Examination
    3. Determination

Standby Attitude Indicator

Description

The SAI or "gyro horizon" installed in HB-IWF (the occurrence aircraft) was manufactured by Thomson-CSF Sextant (PN H321BVM1). The spherical display drum is divided into two colours: blue indicates "climb" and brown indicates "dive." The SAI is powered by the battery bus through CB B1-865 located in the overhead CB panel at position C-01. The battery bus is in turn redundantly powered by TR 1, TR 2A, TR 2B, and TR 3.

From CB B1-865, wire B201-166-24 is routed from the overhead tub via wire runs AMN, AMP, AMK, and AMH to pin N of P1/R5 329 located in the avionics disconnect panel. Wire B203-187-24 is then routed into the avionics compartment via wire runs ABC and RBP.

The warning flag comes into view as a result of a loss of power or if the rotor speed falls below 18 000 rpm. The SAI gyro normally operates at 23 000 rpm or higher. Sextant estimates that the flag comes into full view in less than one second.

At 0125:33, the first officer alluded that the flight instruments on his side were no longer functional and that he had to refer to the standby instruments. The SAI is designed to provide reliable information for five to six minutes following a loss of power. After five to six minutes, the gyro begins to tumble with continuously increasing amplitude. After approximately nine minutes, the gyro can be in any position, making it impossible to determine its final position.

Examination

Two SAIs were recovered: the spare SAI and the installed SAI. The spare SAI was carried in the fly-away kit. It was identified by SN 9659, matching the SN in the Aircraft Component Inventory supplied by SR Technics. The unit was contained in bubble wrap and its electrical connector was capped.

Although part of the installed SAI's data plate was missing, some of the PN and SN was nonetheless readable: PN H321??? and SN 96??.[1] According to the Aircraft Component Inventory, the installed SAI would have been identified by SN 9664. It was determined that SAI SN 9664 had accumulated a total time of 17 578 hours and 5 269 hours since it was tested. The installed SAI exhibited more extensive impact damage than the spare SAI.

The casing or protective cover of the installed SAI was extensively deformed; the rear of the casing was pushed forward and downward to the right (as viewed from the front), causing the casing to fold over four or five times on itself.

(See photographs of "SAI casing - front view" and "SAI casing - side view.")

The light plate that held the integral lamps across the top of the indicator was displaced and partially missing. The remaining piece of light plate was still attached to the indicator by the two lead wires. No part of the integral lamps remained. The failure warning flag and the quick erection knob (normally located at the lower right corner) were missing. Although most of the electromagnet that activated the failure warning flag was not recovered, a piece of the electromagnet remained attached to the upper left corner of the frame. The aircraft symbol was not recovered.

The spherical display drum was captured in place by the deformed surrounding frame.

(See photograph of "Spherical display drum - deformed frame.")

The aircraft attitude captured at the time of impact was estimated to be 110 degrees right bank and 20 degrees pitch down. The drum exhibited an indent between the zero-degree pitch line and the 45-degree down pitch line.

The spherical display drum exhibited a distinct red imprint, measuring approximately 9 mm in length and 3 mm in width with a distinct rounded end, in the upper left quadrant along the zero-degree pitch line graduation.

(See photograph of "Spherical display drum - red imprint.")

The imprint was similar in shape and colour to the original fluorescent gyro warning flag. The red imprint was oriented upward toward the left corner where the warning flag arm is attached to an electromagnet. The distance from the rounded tip of the red imprint to the remains of electromagnet measured 32 mm. According to information supplied by Sextant, the overall length of the flag arm, including the flag, was 32.2 ± 0.3 mm. The dimensions of the flag are 13.8 mm by 4.5 mm.

The brown area of the deformed spherical drum exhibited a series of distinct, black imprints.

(See photograph of "Spherical display drum - rear attitude imprints.")

The end of the imprint closest to the zero-degree pitch line had a distinctive rectangular shape measuring 1.5 mm in width. In total, the imprints measured approximately 25 mm in length. According to Sextant, the aircraft symbol (34 mm), including the support arm (16 mm), was approximately 50 mm long and 1.5 mm wide. It is attached to the right side of the casing.

The drum also exhibited a series of circumferential black imprints that matched the shape of the roll dial. These black imprints extended from the 5-degree up graduation on the left to the 65-degree down graduation on the right. The roll index was positioned on the left of the drum approximately 110 degrees from the vertical. The blue area on the drum to the right of the roll index exhibited a small, black smear that was approximately the same width as the roll index support arm.

The spherical drum was removed from the indicator. The surface of the drum directly opposite the in-view surface exhibited a distinct circle of imprints, with an indentation in the centre. All of the imprints were distinct.

The gyro rotor housing was partially protruding through the side of the casing.

(See photograph of "Gyro rotor housing - torsional failure.")

The rotor housing cover was held in place by one of the remaining four screws. The housing exhibited extensive damage, including broken and missing pieces.

(See photograph of "Gyro rotor housing - torsional failure
close-up
.")

The cupric nickel rotor had a light cover of corrosion products. The machined rotor mass consisted of a 2-inch cylinder measuring approximately 1 inch in width with a single bevelled edge. One end of the shaft that supports the rotor had failed. The fractured shaft surface exhibited evidence of a torsional overload failure with extensive surface over-rub. The rotor exhibited comet-like gouges adjacent to both the straight and bevelled edges of the mass. The straight edge adjacent to the cover exhibited three distinct gouges over a circumferential distance of 45 mm. Each of the gouges was located 2 mm from the edge.

Two additional gouges adjacent to the bevelled edge had a melted appearance, unlike the anticipated mechanical damage anticipated to occur at the time of impact. The recovered rotor from the spare SAI also exhibited similar gouges on the rotor surface. According to Sextant, these gouges are caused during the balancing process of the rotor during manufacture. The interior of the rotor mass housing exhibited a number of areas of light scoring and rub contact, many of which bear the characteristic imprint of the machining pattern of the outer diameter of the rotor mass. The housing was machined from a solid block of aluminum alloy and exhibited machine tool markings that are visible under the aluminum paint on both the inner and outer surfaces. These tool markings, however, are much finer than those on the rotor mass surface and the two patterns are easily differentiated.

The wiring in the general area of the SAI wire routing exhibited fire and heat damage. An 11-inch length of wire B201-166-24 exhibited soot damage but no arcing. Four 24 AWG wires exhibited arcing and melting damage. Only one of these wires was positively identified as the fire detector loop A Engine 2 wire.

Determination

The aircraft attitude captured upon impact with the water was estimated to be 110 degrees right bank and 20 degrees pitch down. The capture of the drum and roll index by the surrounding frame and the lack of any evidence indicating that the drum or roll index had moved during or following the impact support this determination.

The fractured surface of the rotor shaft exhibited evidence of a torsional overload failure. The extensive surface over-rub exhibited on the shaft is consistent with continued rotation following separation. The comet-like gouges on the rotor mass adjacent to both the straight and bevelled edges are also consistent with continued rotation of the gyro rotor mass at the time of impact. The actual rotational speed, however, could not be estimated.

The Engine 2 FADEC recorded the last airspeed and altitude to be 228 knots at 1 800 feet asl. At this speed, the SAI would have been crushed in the order of 50 msec; the flag would not have had sufficient time to move from behind the mask to the full in-view position at the time of impact. Since the warning flag was captured in the full in-view position, it was determined that the flag had moved to this position prior to impact. The location of the red imprint on the drum further supports the determination that the warning flag was in full view prior to impact.

Based on the appearance and position of the imprints on the brown area of the deformed spherical drum, it was determined that the imprints were made by the fixed aircraft symbol at the time of impact. It was also determined that the circumferential black imprints that matched the shape of the roll dial resulted from the roll dial being forced into the drum. The marks on the blue area of the drum are consistent with the displacement of the roll index/roll arm further to the left following its initial contact with the surface of the drum.

It was determined that the circle of imprints on the surface of the drum resulted from contact with the bell-shaped forward pitch gear wheel teeth. The indentation in the centre of the gear teeth imprints was consistent with contact with the centre of the gear wheel, which was also forced into the drum. Based on the distinct appearance of the imprints, it was determined that the spherical drum was captured at this position at the time of impact.

In order to determine a more precise pitch attitude, the spherical drum from the spare indicator was removed. The roll dial from the installed SAI was placed overtop the spare drum. The left side of the roll dial aligned at 5 degrees up, and a pitch attitude of 20 degrees nose down was estimated at the mid-point of the roll dial. The installed SAI was also compared to an intact indicator on which the warning flag was in view. The results of this comparison supported the determination that the warning flag was in full view at the time of impact.

(See photograph of "Intact SAI dial face - warning flag in view.")

Although it was determined that the warning flag was in view at the time of impact, the time at which power was lost to the SAI could not be determined. Although the gyro was rotating with high rotational energy at the time of impact, it could not be conclusively shown that the captured attitude represented the actual aircraft attitude at the time of impact.

Standby Airspeed Indicator/Altimeter

Description

The standby airspeed indicator/altimeter was manufactured by Smith Industries Aerospace, PN WL10AMS5, SN AF768. It was installed on 3 July 1997.

Examination

The airspeed dial face was the only part of the standby airspeed/altimeter that was recovered. The dial face, an aluminum circular drum, was extensively distorted. The airspeed dial face exhibited two indentations approximately 20 mm apart located at the 80 knots and 120 knots graduations.

(See photograph of "Standby airspeed indicator - dial face.")

Determination

Based on a comparison of the airspeed dial face and an intact airspeed indicator, it was determined that the drum passed directly in front of two support posts 20 mm apart.

(See photographs of "Exemplar standby airspeed indicator" and "Standby airspeed indicator - support posts.")

By aligning the airspeed dial drum so that the 80 knots and 120 knots graduations aligned with each support, the 300 knot graduation was placed at the airspeed index mark.

Standby Instrument Lighting

Description

The same electrical circuit powers the SAI and the standby airspeed indicator/altimeter integral lights.

Under normal conditions, power originates from the 115 V , AC-1 phase B CB B-523 referred to as "MAIN AND PED INSTR PNL LTG," on the lower main CB panel at position A-13. The wire is routed from the CB to plug/receptacle P1/R5-490 in the lower main CB panel. From R5-490, the wire is routed into the avionics compartment to R5/P1-433. The wire is routed from P1-433 to R5/P1-318 in the captain's console. From R5-318 the wire is routed to terminal HV in the main instrument light controller in the left console. This wire powers the controller. A second wire extends from terminal HV to the standby instruments lights R2-211 relay. This relay is powered as long as power is supplied by the 115 V AC-1 CB A-13.

The voltage in the light controller is stepped down by a transformer and feeds CB B1-532 mounted on the P1 panel. From this CB, the wire stays within the left console and is routed to terminal strip S3-785. A wire is routed from S3-785 to the normally open contact A1 of relay R2-211. From R2-211 common contact A2, this wire is routed to R5/P1-337 on the captain's console. The wire is routed from P1-337 to terminal strip S3-866 where it splits and powers both of the standby indicator lights.

If the power is lost from the 115 V AC-1 Bus or if the CB A-13 trips, the lights are powered by the left emergency 115 V AC bus through CB B1-399, "STBY HORIZON ALTIM LTS BACK-UP," on the overhead CB panel at position C-1. The wire from CB C-1 is routed to the overhead switch panel P1/R5-327 above the lower avionics CB panel over the observer's station. The wire is routed from R5-327 into the avionics compartment P1/R5-414 on the aux rack. From R5-414, the wire is routed to P1/R5-318 on the captain's console. The wire is routed from R5-318 to one side of a step-down transformer, T1-189. The wire from the other side of the transformer is routed to the normally closed contact A3 of relay R2-211. The left emergency 115 V AC bus will automatically supply power to the standby lights in the event of a loss of power to R2-211.

The normal power routing to the standby instrument lights is located below the floor. The lower CB panel is located on the aft cockpit wall.

Examination

Because the wire routing is not located in an area of fire damage, there is no reason to suspect a loss of power to the integral lights.

Determination

The warning flag was in view prior to impact, and was most likely illuminated by the integral light. The light should have been visible unless the density of the smoke obscured the instrument.

Standby Compass Lighting

Description

The standby compass is located at the top of the windshield on the left side of the centre post. The compass must be pulled down to be viewed. The compass is illuminated by selecting the STBY COMP switch located on the overhead light control panel almost directly above the compass. Selecting this switch supplies power from the 28 V DC-1 CB B1-736 located on the lower main CB panel at position D-13.

Wire B114-13-22 is routed via wire run AFW from the CB to P1-497/R5-497 in the lower main CB panel. From R5-497, wire B102-508-22 is routed via wire run AAC to R5/P1-424 in the overhead disconnect switch panel above the observer's station. Wire B203-46-22 is then routed via wire runs AMJ and AMK into the overhead switch panel to terminal strip S3-613, then to R5/P1-204 (also in the overhead switch panel), and finally to pin 9 of the STBY COMP switch. When the STBY COMP switch is selected, pin 11 supplies power back through PI-204 and terminal strip S3-613 to the light in the compass.

Examination

Parts of the wire routing of the standby compass lighting are routed through areas of heat damage, namely, behind the avionics CB panel near the overhead switch panel.

Determination

It could not be determined whether the light in the standby compass was operational at the time of impact.


[1]   Question marks (?) are used to indicate identification numbers or letters that are illegible.

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

Weight and Balance

  1. Weight and Balance Limitations
    1. Weight Limitations
    2. Balance Limitations
    3. Cargo Compartment Limits
  2. Aircraft Empty Weights
    1. Structure Weight
    2. Basic Empty Weight
    3. Basic Weight
    4. Dry Operating Weight
  3. Cargo Weight and Allocation
  4. Passenger Weight and Allocation
    1. Fuel Weight and Allocation
  5. Aircraft Loading Procedure
    1. Passenger Boarding Procedure
    2. Cargo Loading Procedure
    3. Load Sheets
  6. HB-IWF Weight and Balance Calculations Summary
    1. Weight Calculation
    2. Balance Calculation
  7. Final Load Sheet

Weight and Balance Limitations

Weight Limitations

HB-IWF (the occurrence aircraft) was to be operated within the following weight limits:

Table: HB-IWF Weight Limits

Item Weight (kg)
Maximum Taxi Weight 287 120
Maximum TOW 285 990
Maximum Landing Weight 199 580
Maximum ZFW 185 970
Maximum In-Flight Landing Flaps Weight[1] 200 940

Balance Limitations

The C of G limits given in the load index below are valid up to the maximum TOW with landing gear extended.

(See chart of "Actual loaded index ZFW - loaded index TOW.")

Lateral loading is restricted by a maximum unsymmetrical fuel load of 1 800 kg.

Cargo Compartment Limits

The MD-11 has five cargo compartments. The configuration used for SR 111 is Swissair unit load version 260, depicted below.

(See illustration of "MD-11 cargo compartments.")

Table: Cargo Compartments and Unit Load Version 260

Forward Compartment Aft Compartment
1 2 3 4 5
Station Location 506 812 1103 1521 1775 1964 2090
Maximum Capacity (kg) 11 104 15 443 13 480 6 768 3 402
25 401 15 876

Aircraft Empty Weights

Structure Weight

Swissair defines the structure weight as the weight of the aircraft including furnishings and loose equipment.

Basic Empty Weight

Swissair defines the basic empty weight as the combined structure weight and standard fluid weights.

The basic empty weight for HB-IWF (the occurrence aircraft) was as follows:

Table: HB-IWF Empty Weight

Item Weight (kg)
Structure Weight 129 701.7
Water 952
Hydraulic Fluid 179
Engine Lubricating Oil 137
Unuseable Fuel in Tank 562
Unuseable Fuel in Lines 276
Standard Fluid Weight 2 106.0
Basic Empty Weight 131 807.7

Basic Weight

Swissair's weight control system uses average basic weights for groups of the same aircraft type and configuration. HB-IWF was in the 131 925 kg basic weight group.

Dry Operating Weight

Swissair defines the dry operating weight as the basic weight plus operational items, including crew members, their baggage, and pantry items (e.g., galley, bar, food, and beverages). Swissair uses standard weights for crew members (90 kg each); the pantry weight is based on the style of pantry. SR 111 had 14 crew members and pantry code M.

The dry operating weight for HB-IWF was as follows:

Table: HB-IWF Dry Operating Weight

Item Weight (kg)
Basic Weight 131 925
14 Crew Members (90 kg each) 1 260
Pantry M 4 645
Dry Operating Weight 137 830

Cargo Weight and Allocation

The following cargo weights and allocations for SR 111 were provided by Swissair and verified during the investigation based on collected waybills.

Table: SR 111 Cargo Weights and Allocations

Compartment Position Cargo / Baggage Weight (kg)
(includes container weight)
Load Planner Calculations Investigation Findings
1 11 1 430 1 430
  12 790 804
  13L 1 065 1 064
  13R 642 642
  14L 870 870
  14R 734 734
Subtotal   5 531 5 544
2 21 1 355 1 372
  22 2 185 2 162
  23 3 005 3 007
Subtotal   6 545 6 541
3 31 2 850 2 766
  32 1 920 1 829
  33 750 714
Subtotal   5 520 5 309
4 41L 360 360
  41R 292 292
  42L 411 411
  42R 819 819
  43L 258 258
  43R 649 649
Subtotal   2 789 2 789
5 (Bulk)   740 744
Grand Total   21 125 20 927

Passenger Weight and Allocation

(See illustration of "Passenger sections.")

The tables below detail the number of passengers assigned seats in each section, the distribution of passengers by gender and age, and standard passenger weights used in load calculations.

Table: Passenger Summary from Passenger Manifest

Passengers by Section Passengers by Gender[2]
First Class 10 Male 174
Business Class 42 Female 39
Economy Class 161[3]    
Total 213 Total 213

Table: Passenger Summary from Post-accident Review

Passengers by Gender Passengers by Age
Male 125 Adults (12+) 210
Female 90 Children (2–12) 3
    Infants (<2) 2
Total 215 Total 215

Table: Swissair Standard Passenger Weights

Passenger Weight (kg)
Adults (12+) 84
Children (2–12) 35
Infants (<2) 0
Crew Members 90

Fuel Weight and Allocation

Allied Fuels fuelled the aircraft with Jet-A fuel while it was parked at the gate at 2340. The total fuel weight was as follows:

Table: SR 111 Total Fuel Weight

Tank Weight (kg)
Tank 1 18 450
Tank 2 27 550
Tank 3 18 350
Upper Aux 850
Tail 100
Total 65 300

The flight plan indicated that SR 111 would use 1 000 kg of fuel for taxi and 49 600 kg for the trip. The actual taxi fuel used, as recorded on the FDR, was 720 kg. The take-off fuel was estimated at 64 300 kg. The aircraft taxied with a total fuel load of 65 300 kg. A fuel density of 0.812 kg/L was used for SR 111 weight and balance calculations.

Aircraft Loading Procedure

Passenger Boarding Procedure

  1. When a passenger purchases a ticket for a flight, their personal information is recorded in the airline's reservation system, including whether the passenger is male, female, a child, or travelling with an infant.
  2. When the passenger checks in for the flight, the passenger is issued a boarding pass and assigned a seat.
  3. The passenger's seat number and weight category information (i.e., male, female, child, infant) is electronically transferred to the load planner's electronic worksheet.

Cargo Loading Procedure

  1. Approximately two hours before the aircraft is loaded with cargo, containers, or bulk (i.e., loose items), the load planner completes a preliminary plan for loading.
  2. Once the aircraft is ready to be loaded, the load planner provides the ramp personnel with a loading instruction sheet.
  3. Once the aircraft is loaded, the ramp personnel advise the load planner of the actual loaded positions of the containers and the number of bulk items.

Load Sheets

  1. During the cockpit preparation, the flight crew inserts the flight plan and preliminary load sheet figures into the FMS to get a complete flight plan calculation.
  2. The load planner inputs the data from the ramp personnel into the load control computer. The computer automatically calculates the C of G and operational weights for take-off based on the aircraft weight, the cargo weight, the passenger weight, and the fuel weight.
  3. Prior to pushback, the flight crew receives a printed final load sheet from the load planner via the ACARS.
  4. The flight crew examines the final load sheet and inputs the ZFW and the MACZFW C of G into the fuel initialization page of the aircraft's FMS using the MCDU. The actual TOW and the actual take-off C of G is then calculated by the FMS.

HB-IWF Weight and Balance Calculations Summary

Weight Calculation

The information provided by Swissair indicated that the actual dry operating weight was 137 713 kg. The cargo weight was calculated by Swissair as 21 125 kg. Calculations performed during the investigation indicated that the total weight of the cargo, including passenger baggage as determined by waybills and standard weights, was 20 927 kg. While the 198 kg difference in cargo weight could not be resolved using the waybills provided, this difference represents less than 0.1% of the TOW. From an aircraft loading standpoint, this difference is negligible. Swissair calculated the passenger weight by multiplying the standard weight of 84 kg by the total number of passengers, excluding infants. Calculations performed during the investigation determined the following weights:

Table: Weights

Item Weight (kg)
Dry Operating Weight 137 713
Cargo Weight 20 927
Passenger Weight 17 892
ZFW 176 649
Fuel Weight 65 300
Taxi Fuel –720
Gross TOW 241 112

The load control computer calculated the estimated TOW of SR 111 to be 241 147 kg. A detailed calculation performed after the occurrence revealed that the actual TOW was 241 112 kg. The 35 kg difference is negligible. Both weights are within the maximum structural limits.

Balance Calculation

The load control computer calculated the C of G to be 19.8% MAC. Using the balance table, the C of G was manually calculated to be 20.0% MAC. Both of these figures are well within the balance limits.

Final Load Sheet

(See copy of "Final load sheet.")


[1]    Limitation to prevent flaps from being overstressed when selecting landing flaps in flight at weights in excess of normal landing weights.

[2]    There is a difference between the Passenger Manifest and the Post-accident Review of the passengers by gender. This is attributed to the ticketing information. The passenger names were correct, but the gender was incorrect on the manifest. Gender information is used for weight calculations. Swissair used the same standard weight for males and females; therefore, the difference in the gender was inconsequential.

[3]    There were two infants who were not ticketed or assigned a seat, but who were included in the load control.

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

Meteorological Conditions

  1. General
  2. Area Forecast
  3. Additional Terminal Aerodrome Forecasts
  4. Additional METARs
  5. Winds and Temperatures Aloft in the Halifax Area
  6. Significant Meteorological Information
  7. Pilot Weather Reports
  8. Thunderstorms
  9. Lightning
  10. Weather Received from British Airways Flight 214 (Speedbird)
  11. Weather Requested by Flight Crew via ACARS
  12. Pre-flight Briefing
  13. Weather Observed on the Ground in the Vicinity of Peggy's Cove
  14. Weather Observed in the Air in the Halifax Area
  15. Other Information
  16. Turbulence
  17. Icing
  18. Instrument Meteorological Conditions

General

At 0000 on 3 September 1998, Hurricane Danielle was located approximately 300 nm southeast of Halifax. Nova Scotia was under the influence of a weak ridge of high pressure and the distant effects of the hurricane. The other active weather system near the flight track of SR 111 was a line of thunderstorms moving through the New York area. The forecast effects of both systems were moving in a predictable manner.

It is likely that SR 111 was avoiding the thunderstorm that was reported overhead the airport at 0010 just after departure. If the line of thunderstorms were moving eastward at 30 knots, then the thunderstorm would have been 4 to 5 nm east of the airport at the time of departure. A satellite image depicts the meteorological conditions 47 minutes prior to the accident.

(See photograph of "Infrared satellite image - 0045.")

Area Forecast

For the geographical area of eastern New York, the FAUS5 for the FA1W issued at 1745 on 2 September 1998 and valid until 1200 on 3 September 1998, predicted scattered clouds at 4 000 feet, broken clouds at 8 000 feet, layered clouds up to 18 000 feet, widely scattered, light rain showers or thunderstorms with light rain (the thunderstorms possibly severe), and cumulonimbus clouds with tops at 40 000 feet. The updated FA1W issued at 0045 on 3 September 1998 predicted broken clouds at 4 000 to 6 000 feet with tops at 18 000 feet, widely scattered, light rain showers, isolated thunderstorms with light rain, and cumulonimbus clouds with tops at 40 000 feet.

(See illustration of "Halifax area forecast regions - FACN35 region.")

The FACN35 covered Halifax and the surrounding maritime provinces. This district comprises the following regions: Gaspé, Gulf, New Brunswick, Straits, West Scotia, and Sable. The accident site is within the West Scotia region (area 5) of the FACN35. The prognosis for the FACN35, issued at 2330 on 2 September 1998 and valid from 0000 to 1200 on 3 September 1998 indicated that, at 0000, there was a weak upper trough running north-northeast to south-southwest in the western part of the district. This trough was forecasted to move eastward at 20 knots to lie in the vicinity of Fredericton, New Brunswick, at 1200. At 0000, Hurricane Danielle was forecast to pass well south of the Sable region overnight. Patchy, low-level moisture was forecast over all the regions, becoming moist at all levels west and near the trough and over the Sable region. Light, easterly winds were forecast over the regions, increasing to moderate and strong easterly winds over the Sable region after the mid-period of the forecast. The forecast weather for the West Scotia region called for scattered, occasionally broken clouds at 2 000 to 3 000 feet with tops at 8 000 feet, broken, occasionally overcast clouds at 10 000 feet with tops at 16 000 feet, and high, broken clouds above 25 000 feet. Visibility was forecast to be greater than 6 sm. The forecast for the district included severe, clear icing in the cumulonimbus clouds and moderate, mixed icing in the altocumulus and towering cumulus. However, light to moderate rime icing was forecast elsewhere in clouds above freezing level. The freezing level was forecast at 9 000 feet asl in the northern part of the district, rising to 13 000 feet asl in the southern part. The forecast turbulence was moderate to severe in convective clouds, and otherwise light to nil.

Additional Terminal Aerodrome Forecasts

Table: Terminal Aerodrome Forecasts

Airport Issued TAF Information
JFK 2327 and valid from 0000 to 2400 on 3 September 1998 Surface wind 170°T at 12 kt; visibility greater than 6 sm; scattered clouds at 2 500 ft. agl; broken clouds at 13 000 feet; visibility 2 sm in thunderstorms (temporarily from 0000 to 0200); overcast at 2 500 ft. agl in cumulonimbus
CYQI 2244 and valid from 2300 on 2 September 1998 to 1100 on 3 September 1998 Surface wind 320°T at 3 kt; visibility greater than 6 sm; few clouds at 2 000 ft. agl, broken clouds at 7 000 ft. agl, and broken clouds at 25 000 ft. agl

Additional METARs

Table: Additional METARs

Airport Issued METAR Information
KBOS 0056 Surface winds 120°T at 8 kt; visibility 10 sm; sky clear; temperature 17°C; dewpoint 16°C; altimeter setting 29.78 in. Hg
KBGR 0053 Surface winds 220°T at 4 kt; visibility 10 sm; sky clear; temperature 17°C; dewpoint 12°C; altimeter setting 29.77 in. Hg
CYHZ[1] 0200 Surface winds 070°T at 5 kt; visibility 15 sm; broken clouds at 12 000 ft. agl, overcast at 24 000 ft. agl; temperature 17°C; dewpoint 14°C; altimeter setting 29.79 in. Hg; cloud cover: altocumulus 7/8, cirrostratus 1/8
CYAW 0200 Surface winds 050°T at 6 kt; visibility 15 sm; few clouds at 2 000 ft. agl, scattered clouds at 7 000 ft. agl, overcast at 25 000 ft. agl; temperature 17°C; dewpoint 15°C; altimeter setting 29.76 in. Hg; cloud cover: stratus cumulus 1/4, altocumulus 1/4, cirrus 3/8
CYQI 0100 Surface winds 030°T at 3 kt; visibility 15 sm; broken clouds at 5 000 ft. agl and overcast at 8 000 ft. agl; temperature 18°C; dewpoint 12°C; altimeter setting 29.76 in. Hg; cloud cover: stratocumulus 7/8, altostratus 1/8

An automatic weather station at WWE, located approximately 39 sm southwest of the accident site on the Atlantic coast, did not record the cloud layers but recorded the visibility as greater than 9 sm at 0100.

Winds and Temperatures Aloft in the Halifax Area

The forecasted winds for the Halifax area issued at 1530 on 2 September 1998 for use from 2100 on 2 September 1998 to 0600 on 3 September 1998 were as follows:

Table: Forecasted Winds for Halifax

Altitude (ft.) Direction (°T) Speed (kt) Temperature (°C)
18 000 200 13 –9
12 000 200 10 1
9 000 180 8 6
6 000 140 11 10
3 000 100 16 Not available
Sea level 90 10 Not available

The SR 111 FDR data was analyzed to determine the actual winds and temperatures during the descent in the Halifax area. In summary, from 33 000 feet down to 18 000 feet the wind direction veered from approximately 200 to 270°T; from 18 000 to 10 000 feet, the wind direction backed to 180°T. From 33 000 to 10 000 feet, the wind velocity decreased from 66 knots to 4 knots and the air temperature increased from –40 to 4°C; the temperature at 25 000 feet was –25°C and at 12 000 feet was 0°C. (The magnetic variation for Halifax is 20 degrees west.)

(See chart of "Winds vs. altitude.")

Significant Meteorological Information

The SIGMET 1E was issued by the US National Weather Service on 3 September 1998 at 0055 and was valid until 0255 on 3 September 1998. The SIGMET indicated that there was a line of severe[2] thunderstorms extending from 30 nm northwest of Concorde, New Hampshire, through Bridgeport, Connecticut, to 40 nm south of Newark, New Jersey, to 50 nm northeast Baltimore, Maryland. The line was 20 miles wide, moving from the northwest at 30 knots, with cloud tops up to 41 000 feet. The forecast warned of hail of up to one inch in diameter and possible surface wind gusts to 50 knots, mainly south of Bridgeport.

There were no SIGMETs in effect for the FACN35 at or around the time of the occurrence.

Pilot Weather Reports

There were two PIREPs issued for the route of flight on the night of the accident. At 2335, the crew of a Boeing 737 passing through 14 500 feet over Boston reported that there was a broken cloud layer beginning at 3 500 feet extending up to 14 500 feet and no turbulence. At 0335, the crew of a Boeing 747 in the Yarmouth area at FL330 reported smooth flight conditions with light to moderate turbulence in the vicinity of Boston.

Thunderstorms

ATS-recorded communications tapes were reviewed for information about the thunderstorms in the JFK area. At 0014, JFK tower warned aircraft of a Level 5 thunderstorm 15 nm southwest of JFK. (See illustration of "Lightning strike data.") The flight crew of another aircraft on the departure control frequency reported thunderstorm activity over the Merit intersection (50 nm northeast of JFK). The same crew reported that the thunderstorms were in a line from the Merit intersection heading southwest.

The JFK METAR issued at 2351 on 2 September 1998 indicated that there were cumulonimbus clouds in the distance (more than 10 nm from the airport) towards the northwest, with occasional lightning. The JFK METAR issued at 0010 on 3 September 1998 indicated thunderstorms in the vicinity (less than 10 nm) in the west to northwest quadrant moving eastward with occasional lightning. The JFK METAR issued at 0051 on 3 September 1998 indicated thunderstorms in the vicinity to the south and thunderstorms in the distance to the southwest moving eastward with frequent lightning.

The NWS radar systems are able to objectively determine radar weather echo intensity levels using VIP equipment. Thunderstorm intensity levels are classified on a scale of one to six, as follows:

Table: Thunderstorm Intensity Levels

VIP Level Reflectivity
(dBZ[3])
Precipitation
Level 1 18–30 Light precipitation
Level 2 30–38 Light to moderate rain
Level 3 38–44 Moderate to heavy rain
Level 4 44–50 Heavy rain
Level 5 50–57 Very heavy rain; hail possible
Level 6 >57 Very heavy rain and hail; large hail possible

Lightning

The closest cloud-to-ground lightning activity was located approximately 23 nm from the SR 111 track. It is common for horizontal components of cloud-to-ground lightning to channel within a cloud or through several clouds for up to 5 to 10 miles. Once the aircraft was past the BETTE intersection at 0025, all cloud-to-ground lightning and thunderstorm activity was well behind it for the remainder of the flight.

Research conducted by NASA and the National Severe Storm Laboratory[4] on the electromagnetic interaction between lightning and aircraft identified atmospheric conditions conducive to cloud-to-aircraft lightning strikes. In-flight experiments have shown that there are two types of aircraft lightning strikes. The most frequent type (accounting for 90% of events) is lightning that is triggered by the intrusion of an aircraft into a region with an intense electrostatic field. The other type occurs when an aircraft intercepts a branch of natural cloud-to-cloud or cloud-to-ground lightning.[5] Nearly all strikes at any altitude or temperature occur while the aircraft is within a cloud and experiencing some form of precipitation.

There have been reports of several catastrophic accidents and many less serious incidents attributable to lightning strikes over the years. In all instances studied, the accident occurred immediately after the lightning strike as a result of fuel explosion or a combination of severe turbulence and a lightning strike. On rare occasions, there have been reports of damage to aircraft attributable to lightning discovered by maintenance personnel, although the flight crews of these aircraft were unaware that any lightning strikes had occurred. Lightning strikes are usually accompanied by an in-flight disruption (light, noise, static, etc.) The FDR was reviewed for any anomalies that might have indicated any unusual electrical disturbance within the aircraft. No such anomalies were identified.

(See illustration of "Lightning strike data.")

In order for cloud-to-aircraft lightning to occur, SR 111 would have had to have been in a region with an intense electrostatic field. When the aircraft departed JFK, there was a layer of broken clouds at 2 200 to 2 500 feet and another broken layer at 4 000 feet. The aircraft would have passed through the first layer in less than one minute; a minute and a half later, the aircraft had deviated around the weather (likely either cumulonimbus or an isolated thunderstorm). It is therefore unlikely that the aircraft would have built up an electrostatic charge intense enough to promote lightning. Had the aircraft been struck by lightning and had the flight crew considered the outcome of such encounter serious, they would likely have reported it to ATS; routine lightning associated with thunderstorm activity would not normally be reported by flight crews.

Table: Lightning Data at the Time of Departure from JFK[6]

Lightning Strike Data Aircraft Position Distance Between
Aircraft & Lightning
Time Lat. N Long. W Lat. N Long. W sm km nm
0013:33 40.9562 73.8329 40.58899 73.721 26 42 23
0022:16 40.3836 74.2762 40.56564 73.64 36 58 31
0022:16 40.4483 74.2132 40.56564 73.64 31 50 27
0022:16 40.3462 74.2937 40.56564 73.64 38 61 33
0024:51 40.4466 74.3134 40.55191 73.0591 66 107 58
0024:55 40.1977 74.2814 40.55191 73.0481 70 112 60
0025:23 40.5013 74.2265 40.55878 72.9712 66 107 58
0025:23 40.4787 74.2302 40.55878 72.9712 66 107 58
0025:23 40.4783 74.2304 40.55878 72.9712 66 107 58
0025:23 40.4762 74.2423 40.55878 72.9712 66 107 58
0025:24 40.3987 74.2561 40.55878 72.9712 69 110 60
0025:30 40.9706 73.7732 40.56427 72.9506 51 83 45
0026:10 40.2446 74.308 40.59311 72.8435 81 130 70
0026:10 40.2415 74.3058 40.59311 72.8435 81 130 70
0026:10 40.2398 74.3126 40.59311 72.8435 81 130 70
0026:11 40.2434 74.311 40.59311 72.8435 81 130 70
0026:11 40.2478 74.314 40.59311 72.8435 81 130 70
0026:48 40.2761 74.3145 40.61783 72.7432 86 139 75
0026:48 40.2463 74.2384 40.61783 72.7432 83 133 72
0027:02 40.3096 74.2678 40.63019 72.6965 86 139 75
0027:02 40.3149 74.2758 40.63019 72.6965 86 138 75
0027:02 40.3115 74.2658 40.63019 72.6965 86 138 74
0027:15 40.2833 74.3098 40.63843 72.6622 90 145 78
0027:15 40.2829 74.3142 40.63843 72.6622 90 146 79
0027:45 40.3364 74.2664 40.66177 72.5688 92 148 80
0028:01 40.2954 74.2876 40.67413 72.5235 97 155 84
0028:36 40.2721 74.2941 40.69748 72.4301 102 165 89
0028:36 40.2482 74.2751 40.69748 72.4301 102 165 89
0028:36 40.2487 74.2813 40.69748 72.4301 102 165 89
0028:46 40.3085 74.2802 40.70572 72.3958 103 166 89

Weather Information Received from British Airways Flight 214 (Speedbird)

The following Halifax weather information was volunteered by the Speedbird flight crew to the flight crew of SR 111 at 0116: Winds 100 degrees at 9 knots; visibility 15 miles, scattered clouds at 12 000 feet, broken clouds at 25 000 feet; temperature 17°C; dewpoint 12°C; altimeter setting 29.80 in. Hg.

The weather reported by Speedbird was dated 3 September at 0000. The printed code beside the weather report was 030000. The Speedbird flight crew inadvertently stated that the 0000 weather was the 0300 weather.

Weather Requested by Flight Crew via ACARS

After the flight crew noticed the fumes in the cockpit, they discussed checking the weather for various destinations, including New York, Boston, and Bangor. At 0014, the flight crew requested the weather using the ACARS for the following airports: LLSG, JFK, KBOS, and CVQM (unknown). It is possible that the flight crew intended to input CYQM, which is Moncton, New Brunswick, an airport 90 nm northwest of Halifax.

Pre-flight Briefing

Weather information at the FOC is obtained through FOCUS. This system is based in Zurich and provides information to all the Swissair stations. Weather maps are obtained from Washington, DC, from the NWS.

At approximately 1900 on the day of the flight, the FOC sent a pre-flight package to the hotel where the flight crew was staying for the flight crew to review. Included in this package was the routing information, weather information, and the planned load. Although a briefing is not necessary if there are no flight irregularities, the FOC at JFK briefs pilots on every flight in order to establish a good relationship between dispatch and the pilots. The official flight plan, which includes Notices to Airmen, routing information, weather information, and the actual weight is provided to the pilots when they arrive and they are typically briefed by the FOO responsible for creating the flight plan. If there is a change in the flight plan, it is usually initiated by the flight crew. Such a flight track change may result if the crew decides to carry a minimum fuel load. On occasion, the aircraft might have a two-hour taxi time. Once the flight crew has been briefed and has approved and signed the flight plan, they proceed to the aircraft. The gate staff controls security to the jet way where there is a cipher lock to the jetway.

During the pre-flight briefing, the flight crew was told about a weather system in the area caused by Hurricane Danielle. As a result of this weather, their track would take them further north. The crew accepted the change and signed the flight plan. The taxi and take-off from JFK were unremarkable with the exception of the crew requesting a diversion from ATC around some weather upon departure.

Weather Observed on the Ground in the Vicinity of Peggy's Cove

According to observers inland, on the coast, and on the ocean near the accident site, the sky was overcast and it was hazy or foggy over the water with the base of clouds being much higher inland. These observations were generally consistent with the forecast and aftercast weather produced by EC. Observers on the shore near the accident site saw the aircraft as it flew by and estimated it to have been about 700 to 1 000 feet agl.

Weather Observed in the Air in the Halifax Area

The crew of an aircraft that had departed Halifax shortly after the accident offered assistance to ATS. The controller gave the crew radar vectors to steer the aircraft along the radar track of SR 111. As the vectored aircraft was cleared to descend to 3 000 feet asl, it encountered a broken cloud layer with tops at 5 000 to 7 000 feet. At 3 000 feet, the crew initially were unable to see the surface of the earth, but an opening in the clouds allowed the crew to descend visually down to 1 500 feet. At 1 500 feet, the flight crew was able to see the moon through the broken layer and was able to identify the lights of emergency vehicles on the ground. The flight crew was unable to identify any aircraft wreckage on the ground or in the water.

The flight crew of another aircraft was approaching Halifax from the northwest at the time of the accident. The captain stated that the visibility was good below the base of a cloud layer at approximately 12 000 feet and that it was a black night with no visible horizon.

Other Information

There is an EC Upper Air Station at Yarmouth, Nova Scotia, 133 miles west of Halifax. This station recorded data 1 hour and 15 minutes before the aircraft's descent from FL330. The top of cloud was at 16 000 to 17 000 feet and the freezing level was at 11 000 to 12 000 feet.

Good visibility and ambient light conditions should have prevailed above the top of cloud as the moon's disk was 85% full and 26 degrees above the horizon.

Turbulence

ATS-recorded communications tapes were reviewed for information about turbulence. Near the eastern tip of Long Island, New York, there was a report of light, and occasionally moderate, turbulence at FL280 and light turbulence at FL310. South of Cape Cod, Massachusetts, there was a report of very light continuous turbulence at FL290. All aircraft reported that FL330 was smooth (no turbulence), while FL350 had moderate turbulence. At no time did the flight crew of SR 111 comment on turbulence to ATS while in US airspace. When SR 111 approached Canadian airspace and contacted Moncton Centre, the controller informed the flight crew that there were reports of occasional light turbulence at all levels. Moncton Centre also informed other aircraft of the reported light turbulence at all levels in the area. Shortly after the unusual odour in the cockpit was detected, the seat belt lights were activated in reaction to the light turbulence being experienced.

For the most part, the flight would have been in smooth air with occasional light turbulence. It is possible, however, that during the departure and climb-out from JFK, SR 111 may have encountered some turbulence due to the proximity of thunderstorms. Subsequently, the flight would have flown in smooth air with occasional turbulence until it reached Canadian airspace, at which time light turbulence was reported.

Icing

A review of the FDR data revealed that the wing, tail, and engine anti-ice valves were closed during the flight.

Data from the Upper Air Station at Yarmouth revealed that the freezing level was approximately 12 000 feet. The area forecast predicted that the freezing level to the south of the district was 13 000 feet, lowering to 9 000 feet in the north, with light rime icing in cloud. The FDR also revealed that the freezing level was approximately 12 000 feet. The TAFs and METARs for Halifax and Shearwater indicated that there was a cirrus layer at approximately 25 000 feet. When the aircraft was descending through this cloud layer, it is likely that the aircraft did not encounter any airframe ice owing to the cold temperatures and sparse amount of cloud. The next layer of clouds had a base of approximately 12 000 feet. As SR 111 entered this cloud, it is possible that it encountered some icing to approximately 12 000 feet; however, the amount and duration would have had a negligible effect and any accumulation on the aircraft would have dissipated by 12 000 feet. The FDR revealed that the airframe and engine anti-ice systems were not utilized, indicating that the flight crew did not turn on the anti-ice systems. There was no freezing precipitation either forecasted or reported.

Instrument Meteorological Conditions

The flight that approached the Halifax airport from the northwest would have had cloud cover below them in the distance towards the sea. This would obscure the distant horizon and increase the darkness of the night. Likewise, when SR 111 was tracking toward the ocean, it would have been dark over the sea as a result of the cloud cover, mist, and lack of surface lights.


[1]    The flight crew of SR 111 also received a METAR for CYHZ from the flight crew of another aircraft, which was reported as the 0300 METAR. Observations for the 0300 METAR had not been taken at this time; however, the information passed to the crew of SR 111 was identical to the 0000 METAR.

[2]    A thunderstorm is classified as severe when it contains one or more of the following phenomena:
-  Hail ¾ inch or greater
-  Winds gusting in excess of 50 knots
-  A tornado

[3]    dBZ is a non-dimensional "unit" of radar reflectivity that represents a logarithmic power ratio in decibels, or dB with respect to radar reflectivity factor Z. The value of Z is a function of the amount of radar beam energy that is backscattered by a target and detected as a signal or echo. Higher values of Z and dBZ thus indicate more energy being backscattered by a target. The amount of backscattered energy generally is related to precipitation intensity, such that higher values of dBZ that are detected from precipitation areas generally indicate higher precipitation rates.

[4]    NASA Storm Hazards research program (1980–1986).

[5]    Studying Aircraft Lightning Strikes, P. Lalonde, A. Bondiou-Clergerie, and P. Laroche. European FULMEN Program.

[6]    Lightning strike data provided by Global Atmospherics, Inc.

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

Aids to Navigation

Air traffic control equipment was reported as being fully serviceable. There were no Notices to Airmen in force concerning any service or navigation aid at Halifax International Airport, or for any in the vicinity that would be used by aircraft using Halifax navigation aids.

Halifax International Airport is served by the following navigation aids:

  • A combined VOR navigation aid and DME on frequency 115.1 MHz
  • Two non-directional beacons: the Juliett on frequency 385 kHz and the Golf on frequency 364 kHz
  • Two localizer beams serving each runway: Runway 06/24 is on frequency 109.9 MHz and Runway 15/33 is on frequency 109.1 MHz, which are co-located with a DME with the same frequency

The published instrument approaches for Halifax International Airport consist of the following:

  • An ILS for Runway 15
  • An ILS for Runway 24
  • An ILS Category 2 for Runway 24
  • A localizer back course for Runway 33
  • A localizer back course for Runway 06
  • An NDB for Runway 24
  • An NDB for Runway 06

The ILS for Runway 24 (IJG) was flight-checked on 18 November 1997 and 28 May 1998, and was found to be fully serviceable. The back course was a coincident check.

The ILS for Runway 15 (IHZ) was flight-checked on 19 November 1997 and 28 May 1998, and was found to be fully serviceable. The back course was a coincident check.

The Halifax VOR (CYHZ) was flight-checked on 26 August 1997 and 29 May 1998, and was found to be fully serviceable.

(See illustration of "Aids to navigation at Halifax International Airport.")

Swissair Instrument Approach Chart for Back Course Runway 06

(See illustration of "Back course Runway 06.")

Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
Transportation Safety Board of Canada
Symbol of the Government of Canada

 AVIATION REPORTS - 1998 - A98H0003

Communications

  1. External Communications
    1. JFK Ground Communications
    2. JFK In-Flight Communications
    3. Boston Communications
    4. Thirteen-Minute Communication Gap
  2. Internal Communications
    1. Interphone Call Procedures for Flight and Cabin Crew
    2. Cabin Crew Adherence to Interphone Call Procedures
    3. Communication and Co-ordination between Cabin and Flight Crew
  3. Other Communications
    1. SAR Communications
    2. Cellular Telephone and Satellite Communications
  4. Communications Procedures
    1. Compliance with Communication Procedures
      1. Control Actions and Radio Phraseology
      2. Control Clearances and Radio Phraseology
      3. Landing Information and Phraseology
      4. Altitude Clearances and Phraseology
      5. Radar Vectoring and Phraseology
      6. General Phraseology
    2. Fuel Dumping Procedures
    3. Emergency Response Actions and Communications
      1. Circumstances and Events of the Planned Fuel Dump
    4. Emergency Communications Terminology

External Communications

JFK Ground Communications

The SR 111 flight crew contacted Kennedy clearance delivery at 2336:48 and advised that they would be ready to start their engines in approximately 10 minutes. Kennedy clearance delivery immediately issued an ATC clearance to Geneva, Switzerland, which SR 111 read back. SR 111 was subsequently instructed to contact ground control for taxi clearance. Twenty-two minutes later, at 2359, SR 111 contacted ground control and advised that they were ready for taxi. After receiving progressive taxi instructions over the intervening six minutes, at 0005, the SR 111 flight crew was directed into the take-off queue on the Papa taxiway and advised to contact Kennedy control tower. At 0010, Kennedy tower advised SR 111 to anticipate a Papa Charlie intersection departure. At 0016:09, Kennedy tower issued a take-off clearance on Runway 13R from the Papa Charlie intersection. The Papa Charlie intersection is approximately 1 500 feet from the threshold of Runway 13R, leaving approximately 13 000 feet of runway available for take off.

(See map of "SR 111 taxi route at JFK.")

JFK In-Flight Communications

At 0017:04, SR 111 reported that it was beginning the take-off roll and was issued the wind direction and speed (180 degrees at 11 knots) by Kennedy tower. At 0018:47, SR 111 contacted Kennedy departure control and advised that they were on a heading 155 degrees as cleared. Kennedy departure control reported that the flight was identified on the radar (radar contact) and, at 0018:53, directed SR 111 to proceed directly to the BETTE intersection and to climb to 11 000 feet. There were numerous thunderstorms in the vicinity of New York at the time and, at 0019:46, while in the left turn toward the heading directly to the BETTE intersection, SR 111 requested to steer 120 degrees to avoid the weather. (STI) The deviation was approved and the aircraft remained on the 120 heading for seven miles before turning farther left to a heading of 103 degrees, directly to the BETTE intersection. The heading of 120 degrees rather than the direct heading (approximately 106 degrees) to the BETTE intersection, as cleared at 0018:53, permitted SR 111 to deviate approximately two miles further south than the direct route would have taken. At the time of SR 111's departure from JFK, there were several areas of heavy weather in the vicinity and several departures to the south and north were delayed or vectored to avoid thunderstorm cells. There were no reported deviations by flights departing along the route of flight followed by SR 111 in the direction of the BETTE intersection and Nantucket. At 0022:42, control of the flight was transferred to the Boston ARTCC on frequency 132.3 MHz.

Boston Communications

At 0022:42, the aircraft was transferred to the Boston ARTCC (Sardi sector controller) on frequency 132.3 MHz climbing to 11 000 feet. The Sardi sector controller issued a clearance to SR 111 to continue climbing to FL190 and subsequently transferred control to the next appropriate controller (Hampton sector) on frequency 124.52 MHz at 0028. The Hampton sector controller issued climb clearances to SR 111, as traffic allowed, to FL230 at 0028, FL240 at 0030:26, FL250 at 0031:56, and FL270 at 0032:56. The flight crew acknowledged each of these transmissions. At 0033:02, SR 111 was directed to contact the next Boston controller (Cape sector) on frequency 128.75 MHz. When SR 111 did not read back the assigned frequency, the controller repeated the assigned frequency. The flight crew acknowledged by reading back the correct frequency at 0033:12 and indicated that the aircraft was departing the current frequency.

Thirteen-Minute Communication Gap

From 0033:12 to 0046:27 (approximately 13 minutes), the Boston ARTCC Cape sector controller was unable to contact SR 111 on frequency 128.75 MHz despite making eight attempts to do so. At 0034:55, the Cape sector radar controller attempted to contact SR 111 to issue clearance to climb to FL310. No reply was received. At 0036:14, the Cape sector controller requested that the previous controller attempt to contact SR 111 again on the previously assigned frequency. The Cape sector controller was advised that there was no response. At 0039:02, the Cape sector controller again requested the previous controller to contact SR 111 and, at 0039:36, was advised that there was no response.

In an attempt to contact SR 111, the Cape sector radar associate controller reportedly requested that the Augusta sector controller, who was controlling Swissair 104, try to have that aircraft raise SR 111 on the Swissair company frequency. During this conversation, SR 111 made contact with the Augusta sector controller on frequency 134.95 MHz. The Augusta sector controller assigned frequency 133.45 MHz and SR 111 subsequently contacted the next Boston sector controller on that frequency. At 0052:32, the controller cleared the aircraft to climb to FL330, the flight-planned altitude.

Since the FDR does not record changes to VHF radio frequency selections, there is no indication of the frequency the pilot selected. At 0033:21 (13 seconds after the Boston ARTCC Cape sector controller's first attempt to contact SR 111), the FDR channel that records microphone keying indicated that the VHF radio was activated in the aircraft until 0033:25. This transmission was not recorded on any known ATC communications recording device and was not monitored or reported as having been heard by any ATC agency or aircraft.

At 0033:21, the FDR recorded that the VHF 1 radio was keyed for four seconds. This transmission was not recorded, monitored, or reported on or by any ATC communication device, ATC unit, or other aircraft. The FDR samples the status of the VHF transmission key once each second at the 203/1000 point of each second and indicates whether the radio is keyed at that sampling point. The timing of the VHF keying of the aircraft transmitter cannot be taken as an absolute indication that the transmission began at exactly 0033:21 and ended at 0033:24. During the sampling points of seconds 21, 22, 23, and 24, there is a record that the radio was keyed; the keying could, however, have begun a fraction of a second earlier during second 20 from 0033:20.204 or second 21, and ended a fraction of a second later during second 24 or second 25 up to 0033:25.202.

When establishing initial contact with a different controller, the content of Swissair's transmissions are generally similar in content and length. There are three other initial transmissions of similar length made by SR 111 for which transmission and keying data have been correlated: with Augusta sector at 0046:27, with Nantucket sector at 0047:45, and with Moncton ACC Tusky sector at 0058:13. The lengths of these transmissions were examined to determine whether the keying sequence at 0033:21 to 25 may have contained similar content. The transmissions indicated, respectively, three, three, and four seconds of keying activity. The similarity in initial transmission length may indicate that the Swissair transmission at 0033:21 was expected to be a normal initial transmission to the next Boston sector controller. It was, however, not received on the assigned frequency of 128.75 MHz.

FDR data indicate that SR 111 made 11 transmissions during this time, 9 on VHF 1, and 2 on VHF 2. At 0046:27, a transmission was recorded on Boston ARTCC recording devices on frequency 134.95 MHz (Augusta sector). At 0047:02, the FDR indicated another transmission, which was not recorded on the Boston ARTCC recording device. The Augusta sector controller then instructed SR 111 to contact Boston ARTCC Nantucket sector on frequency 133.45 MHz. At 0047:45, SR 111 contacted Boston ARTCC Nantucket sector on that frequency and normal communications resumed. During the 13-minute communication gap, the Boston ARTCC Cape sector controller attempted to contact SR 111 four times on frequency 128.75 MHz, three times on the original frequency (124.52 MHz), and as reported by the FAA, at least once on the aviation emergency frequency, 121.5 MHz. The times of the Swissair transmissions do not coincide with these attempts, indicating that SR 111, in its 11 transmissions, was not responding to these calls. No other aircraft reported hearing any SR 111 transmissions on the applicable frequencies and there was no report of communications difficulties with other aircraft in the vicinity. At 0038:29, the Boston ARTCC Cape sector controller requested SR 111 to squawk "ident" if the transmission was received. No "ident" squawk was observed on ATC radar. There are no discernable keying or transmission sounds on the ATC recording tapes to indicate that a carrier may have been transmitted without voice.

The FAA reported that the concerned controllers followed normal FAA NORDO operating procedure in their communications with SR 111.

At 0053:40, the Boston ARTCC Cape sector controller advised the Moncton ACC high en route controller of the impending transfer of several flights to Moncton's control, including SR 111. At 0058:03, SR 111 was advised to contact Moncton ACC on frequency 135.2 MHz.

Internal Communications

Interphone Call Procedures for Flight and Cabin Crew

Flight and cabin crew procedures for communicating using the interphone system were included in both the CEM and the AOM.

The CEM and the AOM include the following procedures for normal in-flight calls.

Table: Normal In-Flight Calls Procedures

From To Procedure Remarks
Cockpit Cabin Push applicable call button once. One single-stroke chime sounds at station being called.
Cabin Cockpit Push pilot call button once. One single-stroke chime sounds in cockpit.
Cabin Cabin Push applicable call button twice. Two single-stroke chimes sound at station being called.
Cabin Cockpit Push pilot call button for "open door." Two single-stroke chimes sound in cockpit.

The CEM and the AOM include the following procedures for urgency calls.

Table: Urgency Calls Procedures

From To Procedure Remarks
Cockpit Cabin Push all-stations button six times or more. Six single-stroke chimes sound at each flight attendant station. All cabin crew members must reply.
Cabin Cockpit Push pilot call button six times or more. Six single-stroke chimes sound in cockpit. Flight crew must reply. Any flight attendant can make an urgency call.

Urgency calls from the cockpit to the cabin can also be communicated using the PA system, for example, "MC report to the cockpit." Any flight attendant can report to the cockpit to communicate urgent information instead of using the interphone.

In all cases, crew members are required to identify themselves by name and to state the respective interphone station when initiating or receiving an interphone call. This procedure was not consistently followed by the SR 111 cabin crew. It was not uncommon for Swissair cabin crew members, as a group, to engage in normal in-flight interphone calls without identifying themselves and stating the respective interphone station.

Procedures for emergency communication from the cockpit to the cabin include specific announcements on the PA system. Procedures for emergency interphone calls from the cockpit to the cabin are the same as those for an urgency call from the cabin to the cockpit.

Canadian and American carriers do not require cabin crew to identify themselves and the respective interphone station for every interphone call. Although procedures vary, all carriers require that cabin crew members identify themselves and the respective interphone station during emergency calls from the cabin to the cockpit.

Based on the information available, it was determined that overall, the cabin crew of SR 111 performed their duties in accordance with prescribed procedures.

Cabin Crew Adherence to Interphone Call Procedures

Cabin crew members deviated from standard interphone call procedures in that they did not consistently identify themselves and state the respective station during all interphone calls. This behaviour was observed during calls made before and after the cabin crew were aware that there was a problem in the cockpit.

Deviation from interphone call procedures may have been influenced by several factors: cabin crew members recognized each others' voices and, therefore, did not identify themselves; they were aware of which crew members were assigned to which stations and, therefore, did not identify the respective station; and in some cases, they may have been able to see the person with whom they were speaking and, therefore, did not identify themselves or the respective station. Deviation from interphone call procedures during normal operations is not unique to the SR 111 cabin crew.

In this occurrence, deviating from the interphone call procedures did not result in any negative consequences.

Communication and Co-ordination between Cabin and Flight Crew

Within minutes of the flight crew detecting an abnormal odour in the cockpit, the cabin crew was contacted. A flight attendant was asked to come to the cockpit to provide a third opinion on the odour and to describe the cabin environment. This same flight attendant promptly briefed the M/C on the situation in the cockpit. The M/C quickly established communication with the flight crew using the interphone to get a briefing from the captain. The captain's briefing to the M/C was timely and relevant to the perceived situation. During the briefing, the M/C exhibited good communication skills. Within seconds of having been briefed by the captain, the M/C briefed the passengers using the PA system immediately thereafter. The M/C continued to communicate with the cabin crew using the interphone, collected pertinent information, and provided guidance as required.

Other Communications

SAR Communications

The ATC MANOPS article 624 defines the conditions under which an ACC shall advise an RCC of an aircraft in one of the three emergency phases: uncertainty, alert, or distress. Immediately after SR 111 made the Pan Pan call and accepted the suggestion that Halifax could be used for landing, this information was relayed to the ACC supervisor, Halifax Tower, and to the RCC.

Table: ATC MANOPS RCC Notification Procedures

ATC MANOPS Article Procedure
624.1 Inform the appropriate RCC of information regarding an IFR or CVFR aircraft that is in one of the following emergency phases:
(R)
624.1 Reference
Dissemination of Information; 623.
Notification of the Operator; 626.
Communication Search – General; 631.
  A. UNCERTAINTY PHASE if
  1. no communication has been received from an aircraft within 30 minutes after the time a position report should have been received;
  2. a flight plan has been filed and no arrival report has been received by the ACC within 60 minutes after the estimated arrival time last notified to, or estimated by the ACC, whichever is later;
  3. a flight itinerary has been filed and no arrival report has been received by the ACC within 24 hours after the time that the pilot indicated on the flight itinerary; or (N)
    624.1A.3. Note: A pilot wishing search and rescue action to be initiated in less than 24 hours will indicate this in the "other information" portion of the flight itinerary.
  B. ALERT PHASE if
  1. following the uncertainty phase, the communication search has failed to reveal any news of the aircraft; (R)
    624.1 B. 1. Reference: Unsuccessful Search; 634.
  2. an aircraft has been cleared to land and fails to land within five minutes after the estimated time of landing and communication has not been re-established with the aircraft; or
  3. information has been received that indicates that the operating efficiency of the aircraft has been impaired, but not to the extent that a forced landing is likely.
  C. DISTRESS PHASE if
  1. the fuel on board is considered to be exhausted or to be insufficient to enable the aircraft to reach safety;
  2. information is received that indicates that the operating efficiency of the aircraft has been impaired to the extent that a forced landing is likely; or
  3. information is received that the aircraft is about to make, or has made, a forced landing.
624.2 Include the following information, if available, in a notification to the RCC:
  1. A statement of the emergency phase that exists.
  2. Name of unit and person calling.
  3. Significant information from the flight plan, or flight itinerary, such as the following:
    1. Type of flight plan or flight itinerary
    2. Aircraft identification
    3. Type of aircraft
    4. Point of departure
    5. Destination aerodrome
    6. Actual time of departure
    7. True air speed
    8. Estimated time of arrival
    9. Alternate airport
    10. Transmitting and receiving frequencies
    11. Number of persons on board
    12. Pilot's name
    13. Time fuel expected to be expended
  4. Colour and distinctive markings of aircraft.
  5. Time last communication received, by whom, and frequency used.
  6. Last position report and how determined.
  7. Whether two-way communication is available.
624.3 Inform the RCC of any pertinent information that you subsequently receive.
624.4 Inform the RCC without delay when the emergency no longer exists.

In accordance with the ATC MANOPS, article 624.2, the following information was provided to the RCC.

Table: Information Provided to the RCC

Article 624.2 Information Requirement Time Information Provided
A. A statement of the emergency phase (uncertainty, alert, or distress) 0118:14
B. Name of unit and person calling 0118:02
C. Significant information from the flight plan, flight notification, or flight itinerary, including the following sample information:
  1. Type of flight plan, flight notification, or flight itinerary: N/A
  2. Aircraft identification: 0118:07
  3. Type of aircraft: 0118:09
  4. Point of departure: 0118:38
  5. Destination aerodrome: 0118:38
  6. Actual time of departure: N/A
  7. True air speed: N/A
  8. Estimated time of arrival: 0118:48
  9. Alternate airport: N/A
  10. Transmitting and receiving frequencies: N/A
  11. Number of persons on board: Not available
  12. Pilot's name: Not available
  13. Time fuel expected to be expended: Not available
D. Colour and distinctive markings of aircraft Not available
E. Time last communication received, by whom, and frequency used 0132:46
F. Last position report and how determined 0132:46, 0132:57, 0133:16
G. Whether two-way communication is available 0118:03
H. Any action taken by reporting office 0118:14

At 0133:15, the Moncton ACC, anticipating the need for SAR resources, contacted both CFB Greenwood and CFB Shearwater to determine whether either station had aircraft airborne or immediately available to conduct a search.

The first call to the Halifax RCC took place at 0118:00, approximately 13 minutes prior to the crash. After receiving the information from the ACC that the aircraft was no longer visible on radar, and in the absence of any information that the aircraft may have crashed on land, the RCC immediately began directing available shipping resources to the entrance of St. Margaret's Bay to search for evidence of the aircraft. Shortly thereafter, tasking orders were issued to the Search and Rescue Squadron at CFB Greenwood to launch aircraft to carry out the search for SR 111. (STI)

Table: Halifax RCC Activities

Time Action
0118 The Moncton ACC called the Halifax RCC to inform them that an MD-11 reported smoke in the cockpit and was diverting to Halifax.
0130 The Moncton ACC called the Halifax RCC to inform them that SR 111 was lost off radar approximately 40 nm southwest of Halifax.
0130-0140 The Halifax RCC called 14 Wing CFB Greenwood and initiated a base recall and tasked both primary SAR aircraft (Labrador and Hercules). The Halifax RCC also requested potential additional resources (Auroras, Challengers, medical staff, etc.).
0130-0140 The Halifax RCC called 12 Wing CFB Shearwater and initiated a base recall. The Halifax RCC also inquired about potential additional resources (Sea Kings, medical staff, etc.).
0138 The Halifax RCC called and tasked SAR lifeboat CCG Sambro.
0138 The Halifax RCC called Marine Traffic and Traffic Services Halifax to broadcast a Pan Pan on incident and look for vessels of opportunity.
0142 The Halifax RCC called the RCMP and informed them of the situation.
0144 The Halifax RCC called the Queen Elizabeth II Hospital and informed them of the situation and its potential consequences.

The RCC Halifax provided the following list of resources, tasking times, response times, and on-scene times for the initial SAR resources.

Table: SAR Resource Activities

Resource Tasking Time Response Time On-Scene Time
CCG Sambro 0138 0154 0251
Labrador 0130-0140 0225 0250
Hercules 0130-0140 0250 0315

Cellular Telephone and Satellite Communications

The investigation team examined whether any crew members or passengers may have conveyed any messages from SR 111 by methods other than normal ATC or company communications.

There were two methods by which individuals may have made contact with agencies or individuals outside of the aircraft: SATCOM telephone facilities provided by Swissair on board the MD-11 for the convenience of passengers, or cellular telephones carried and used by passengers. Cellular telephones could have been used over one of the two mobile service providers' cellular networks in eastern Canada.

The SATCOM service to which Swissair subscribes for passenger voice communications is provided by SITA. SITA provided information on satellite communications as recorded in their usage logs for HB-IWF (the occurrence aircraft) for the period prior to the accident. They summarized the log review as follows:

During 2330 UTC Sep 2nd and 0231 UTC Sep 3rd, no voice communication over SATCOM was recorded in our logs. This is also confirmed by Laurentides GES, which reported no alarms or any emergency distress calls during this time frame. As footnote, the last voice communication recorded for HB-IWF was placed on flight SR 102 at 15:25 UTC, on September 2nd, with an APC call of 10 min 15 sec long. So, SATCOM was working on HB-IWF.

SITA advised that, according to their data, there were no SATCOM telephone calls made from SR 111 during the flight. SITA's analysis of all SR 111 flights from 1 August to 2 September 1998 showed that this flight does not normally experience a large number of voice calls by either passengers or by crew members, likely because it is a night flight. From 1 August to 2 September 1998, there was SATCOM voice phone call activity on only 19 flight days totalling 70 calls, most of which took place near the end of the flight, on arrival in Switzerland. Therefore, it is likely that in the hour after take-off there were no attempts to use the satellite communications telephone service.

Maritime Telephone and Telegraph Company and Rogers/Cantel provide the mobile cellular telephone facilities in Nova Scotia and New Brunswick that might have been used by owners of cellular telephones on SR 111. Both companies provided records of the calls that were handled by their facilities in Nova Scotia on 2 September 1998 between 0100 and 0130. These records included both the phone number dialing and the phone number dialed. The RCMP provided the available information on the home and cell phone numbers of the passengers on board SR 111. There were no matches between the numbers recorded by the cellular service providers as having been called during the period and the known phone numbers of the passengers or relatives. There has been no report of persons having received calls from any cellular phone or from any passenger in the aircraft by any means.

Communications Procedures

Compliance with Communication Procedures

Control Actions and Radio Phraseology

The control actions taken by the controllers in their handling of SR 111 included

  • issuing control clearances to the aircraft with which to comply under its own navigation;
  • issuing clearances to descend; and
  • issuing radar vectors.

Control Clearances and Radio Phraseology

Table: ATC MANOPS Control Clearances and Radio Phraseology Procedures
ATC MANOPS Article Procedure
135.3 Issue a revised altimeter setting if the setting changes by 0.02 inches or more.
412.1 Issue clearance items, as appropriate, in the following order:
(N)(R)
  1. Prefix
  2. Aircraft identification
  3. Clearance limit
  4. SID
  5. Route
  6. Altitude
  7. Mach number
  8. Departure, en route, approach, or holding instructions
  9. Special instructions or information
  10. Traffic information
412.1 Note: It is important that an IFR clearance contain positive and concise data phrased in a consistent manner.
415.2C If amending both route and altitude, ensure that all applicable route and altitude restrictions remain in effect.
201.4 Identify the station calling and use the words "THIS IS" unless there is no likelihood of misunderstanding as to the source of the transmission.
215.2 You may omit the name and the function of the unit from a radio transmission provided
  1. the unit has been previously identified;
    215.2 A. Example: CANADIAN TWO FOUR SEVEN CHANGE TO MY FREQUENCY 128.5.
  2. only one function is being provided; and
  3. there is no likelihood of misunderstanding.
103.1 Use the phraseology contained in this manual whenever possible. If a situation arises for which phraseology is not provided:
  1. Use words and phrases from Appendix 1; and
  2. If words and phrases from Appendix 1 are not found to be suitable, use language that is clear and concise.

There were two situations in which clearances were issued to the aircraft with which ATS initially expected the aircraft to comply under its own navigation: upon the high en route controller's issuance of clearance for SR 111 to turn right to Boston and upon the controller's subsequent clearance of the aircraft to Halifax. Both clearances maintained the essential elements of destination, turn instructions, and altitude.

In issuing these clearances to Boston and to Halifax the controller did not, and in the circumstances was not required to, use the term "This is Moncton Centre" after the initial contact in accordance with the ATC MANOPS, article 215.2. The controller also used the approved terms "turn right" and "proceed" as directed in the ATC MANOPS, Appendix 1, when issuing clearance to SR 111 to begin the turn to Boston and proceed direct for the turn to Halifax. In both cases the controller monitored the actions of SR 111 on radar to ensure that the aircraft was responding as expected.

Landing Information and Phraseology

Landing information is required to be issued to arriving aircraft in accordance with the MANOPS articles below.

Table: ATC MANOPS Landing Information and Phraseology Procedures
ATC MANOPS Article Procedure
341.1 Issue landing information to arriving aircraft:
341.1 Note: Except for the current altimeter setting, you need not issue information that you know the aircraft has already received.
  1. on initial contact; or
  2. as soon as practicable.
341.1 B Note: Landing information should be issued in time to be of use to the pilot.
471.1 If direct controller pilot communications is used, issue landing information before or shortly after the descent clearance.
471.2 Include the following items, as appropriate, in landing information:
  1. Wind
  2. Visibility
  3. Ceiling
  4. Altimeter setting
  5. Pertinent remarks from the current weather report
  6. STAR, including STAR transition, or FMS arrival
  7. Runway in use
  8. Approach aid in use
  9. Pertinent airport conditions
471.3 You may use the term "CAVOK" if applicable.
471.4 Except for the altimeter setting, you need not issue information included in the current ATIS broadcast, provided the aircraft acknowledges receipt of the broadcast.
471.5 Issue an aircraft any subsequent information that may affect its descent, approach, or landing.

SR 111 received all of the information listed in the ATC MANOPS, article 471.2 from Speedbird 214, the high en route controller, and the Halifax terminal controller.

Altitude Clearances and Phraseology

Altitude clearances were issued by both the high en route controller and the Halifax terminal controller. When issuing altitude instructions, the ATC MANOPS directs controllers to use phraseology, for example:

  • MAINTAIN (altitude), or
  • CLIMB/DESCEND TO (altitude).

In all descent clearances except one, the controllers' radio phraseology complied with the directions in the ATC MANOPS. The single exception occurred when SR 111 was cleared to descend to 10 000 feet by the high en route controller; the context and the message, however, were clear and appeared to be understood by the SR 111 flight crew.

One other altitude-related clearance governed by the ATC MANOPS was issued by the Halifax terminal controller. At 0124:25, SR 111 requested permission to fly between 9 000 and 11 000 feet. The Halifax terminal controller issued clearance for a block altitude between 5 000 and 12 000 feet. The conditions under which a block altitude may be authorized are specified in the ATC MANOPS, article 432.5, and the conditions under which it may be requested are specified in article 432.2 C, which specifies that a request may be made based on icing, turbulence, or fuel considerations. The controller authorized the block, complying with the direction of the ATC MANOPS, article 601.2 A, which directs controllers to "...provide as much assistance as possible to the aircraft in distress."

Radar Vectoring and Phraseology

The ATC MANOPS, Part 5, "Radar Procedures," provides direction to controllers on the procedures and phraseology to be used when providing radar vectors to aircraft.

Table: ATC MANOPS Radar Vectoring and Phraseology Procedures
ATC MANOPS Article Procedure
541.2 Vector an aircraft if
  1. necessary for separation purposes;
  2. required by noise abatement procedures;
  3. you or the aircraft will gain an operational advantage; or
  4. the aircraft requests it.
541.3 If you initiate vectoring, inform the aircraft of (P)
  1. the purpose of vectors; and
  2. the fix, airway, or point to which the aircraft is being vectored.
541.3 Phraseology:
VECTOR TO (fix or airway).
VECTOR TO INTERCEPT (name of NAVAID) (specified) RADIAL/COURSE.
VECTOR TO FINAL APPROACH COURSE.
VECTOR TO RUNWAY (number) TRAFFIC CIRCUIT.
545.1 Inform an aircraft of its position when
  1. identification is established by an identifying turn;
  2. vectoring is terminated;
  3. Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
    Transportation Safety Board of Canada
    Symbol of the Government of Canada

     AVIATION REPORTS - 1998 - A98H0003

    Aerodromes

    1. JFK Airport
    2. Ground Handling at JFK
      1. Swissair Security Procedures at JFK
      2. Aircraft Maintenance at JFK
    3. Halifax International Airport
      1. Halifax International Airport Emergency Response

    JFK Airport

    JFK airport is in Jamaica, Queens County, New York, 13 nm southeast of the City of New York. The geographic position of the airport is latitude 40°38'23" N and longitude 73°46'44" W, with a field elevation of 13 feet above mean sea level. The airport is owned by the City of New York and operated by the Port Authority of New York and New Jersey. ATC services are provided by an ATC tower at the airport, and radar services are provided by the New York ARTCC. There are two sets of parallel runways: runways 13/31 left and right and runways 04/22 left and right. The magnetic variation for the airport is 13 degrees west. SR 111 departed from Runway 13 R, which is 14 572 feet long and 150 feet wide. The runway is constructed of asphalt and concrete.

    (See illustration of "JFK Airport.")

    Ground Handling at JFK

    On 2 September 1998, the occurrence aircraft, inbound from Zurich, Switzerland, landed at JFK at 1716 and arrived at Gate 6 of Terminal 3, the Delta Airlines Terminal, at 1722. The aircraft was met at the gate by two security guards. One boarded the aircraft from the jetway as the main aircraft door was opened to disembark the passengers, the other was always present on the ramp during the off-loading of cargo and baggage. The security guards were contract personnel with an external security company; however, most of them had been with the company for several years. They were able to contact the base at the airport via a hand-held radio if they needed assistance or relief.

    After the passengers disembarked, the on-board security guard inspected the overhead bins, the seats, and other areas of the aircraft to ensure that nothing had been left behind by anyone. A thorough physical search of the aircraft was completed.

    Because there are limited gate facilities at JFK and Terminal 3, the aircraft had to be moved from the gate to a hard stand (parking area on the apron) and accessed by portable stairs; the aircraft remained there until a gate was available. The aircraft was towed to parking spot 74. The security guard remained on board the aircraft until 2200, at which time another security guard relieved the first guard. During the first guard's shift, the aircraft cabin was groomed (cleaned) by approximately 20 cleaners during a period of 45 minutes. The guard was responsible for screening and monitoring personnel boarding the aircraft to perform the grooming. During the second guard's shift, the food for SR 111 was delivered. The second guard remained on board the aircraft as it was towed back to Gate 6 and deplaned when the crew arrived, at which time he stationed himself outside the aircraft door on the jetway until all the passengers had boarded SR 111. The aircraft pushed back from the gate at 2353, taxied from the terminal across the ramp, and exited the ramp via taxiway "KK."

    (See illustration of "JFK, Delta Terminal.")

    Swissair Security Procedures at JFK

    Any cash being transported on board would have been locked in a sales container and seals put on the locks by the cabin crew. The security personnel verified that the seals were secure. There was no official paperwork involved in this process.

    The Port Authority Police were present for the loading and unloading of valuables. Outbound valuables were transported by armoured car from the cargo facility to the aircraft. The valuables were stored at the cargo facility in a bunker. The bunker, presided over by a security guard, has a watch room (a screened-in area, which is locked) and a vault for valuable items.

    The security guard signed out valuables, which were loaded onto a transport vehicle. The transport vehicle was escorted by an armed, uniformed guard, and Port Authority Police, who stayed with the cargo until it was loaded.

    For inbound flights, ramp security personnel conduct a physical check of the cargo bays and place tape seals over the doors. To do so, they get on top of high loader equipment and look around using a flashlight to ensure that the cargo bays are empty. They also physically check the cargo bays when the aircraft is returned to the gate.

    Audits of the security practices at JFK were conducted semi-annually by Swissair quality assurance personnel from Zurich.

    Aircraft Maintenance at JFK

    On the day of the occurrence, when HB-IWF arrived from Zurich, it had only one maintenance write up. The cabin crew complained that the rear lavatory had a bad smell. Maintenance personnel investigated and cleaned the lavatory. One of the maintenance workers noticed that one taxi light on the nose gear had a cracked lens, and it was changed. This maintenance action was not noted in the log book. The maintenance supervisor was informed of the light bulb change after the accident when he came into the office at 0700.

    Halifax International Airport

    Halifax International Airport, is at latitude 44°52'51" N and
    longitude 63°30'31" W, with a field reference elevation of 477 feet above mean sea level. The airport was owned and operated by Transport Canada (Government of Canada). There are two landing surfaces: Runway 15/33 and Runway 06/24. The magnetic heading for Runway 06 is 056 degrees. The magnetic variation in the Halifax area is 20 degrees west. Runway 15/33 is 7 700 feet long and 200 feet wide and is constructed of asphalt. Runway 06/24 is 8 800 feet long and 200 feet wide, and is constructed of asphalt and concrete.

    (See illustration of "Halifax International Airport.")

    Halifax International Airport Emergency Response

    Emergency response requirements for Canadian airports are detailed in the CARs, Part III - Aerodrome and Airports, Subpart 3 - Aircraft Fire Fighting at Airports and Aerodromes. Standards are in Section 323, and Advisory Documents in Section 343 of the CARs.

    Halifax International Airport provides Category 8 AFF on a 24-hour basis. To meet this category of response, an airport must have at least three vehicles with a combined total of 18 200 L of water available for the production of aqueous film-forming foam and 450 kg of dry chemical, and must be capable of discharging 7 200 L of liquid per minute.

    On the night of the occurrence, Halifax AFF received instructions from the Halifax Control Tower at 0120 on the tower hotline telephone to take standby positions for a landing on Runway 06. Four vehicles responded to the standby summons. Red 1 and Red 2 were Waltec C5500 AFF vehicles, each containing 5 500 L of water, 225 kg of dry chemical and 660 L of foam. Each of these vehicles was fitted with night-sight capabilities and carried standard aircraft rescue tools. Red 1 was the command and control vehicle and contained one firefighter and one fire officer; Red 2 carried one firefighter. Red 3 was an Oshkosh T3000 AFF vehicle containing 11 300 L of water, 225 kg of dry chemical (potassium bicarbonate), and 1 590 L of foam; this vehicle carried one firefighter. Red 4 was a structural pumper carrying 2 250 L of water and 180 L of foam; this vehicle carried two firefighters.

    (See illustration of "Halifax International Airport - AFF.")

    The AFF vehicles were in their standby positions within one minute after call-out. At 0120:43, after being asked by Moncton ACC to have the fire trucks standing by, the Halifax Control Tower responded that they were already in position. Red 2 took up a position at the touchdown area of Runway 06 and held at the holding bay on taxiway "A." Red 3 and 4 responded to an emergency access road at the approximate runway midpoint and Red 1 held on taxiway "D." The AFF stood down at 0155.

    The Halifax International Airport AFF is required to and meets the service standards specified in the CARs Part III, Section 323 - Aerodrome and Airport Standards Respecting Aircraft Fire Fighting at Airports and Aerodromes.

    Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
    Transportation Safety Board of Canada
    Symbol of the Government of Canada

     AVIATION REPORTS - 1998 - A98H0003

    Flight Recorders

    1. Flight Data Recorder
      1. FDR Anomalies
    2. Cockpit Voice Recorder
      1. CVR Audition Group
    3. Time Synchronization of FDR/CVR/ATS/Radar/FADEC
    4. Quick Access Recorder
    5. Circuit Breaker Study
    6. FDR/CVR Stoppage
      1. FDR Stoppage Time
      2. CVR Stoppage Time
      3. Relative Stoppage Times of FDR and CVR
      4. Possible Causes for Premature Stoppage of Flight Recorders
    7. FDR Anomalies
      1. Weather Diversion, 13-Minute Communications Gap, Air Page Selections
    8. Flight Animation
    9. List of FDR Parameters
      1. Invalid and Valid Parameters in Last Three Subframes of FDR Data

    Flight Data Recorder

    The aircraft's FDR was recovered by divers on 6 September 1998 in approximately 50 m of water. It was escorted to the TSB Engineering facility in Ottawa for analysis. The FDR was transported in distilled water to minimize oxidation from exposure to salt water.

    (See photograph of "Flight data recorder in water.")

    The FDR was an L3 Communications (formerly Loral/Fairchild) Model F1000, SN 00898, which recorded approximately 250 parameters in solid state memory. The F1000, which uses data compression techniques to store data, contained approximately 70 hours of continuous flight data.

    The ULB for the FDR was intact and attached to the crash-protected memory module. The brackets that held the beacon were damaged substantially, but still held the beacon in place.

    (See photograph of "Underwater locator beacon partially attached to recorder.")

    The recorder was rinsed in a fresh water bath and then disassembled. The crash-protected memory module was kept submerged in water as much as possible, to minimize the effects of oxidation. The internal crash module was removed from the outer dust cover and internal housing. The internal crash module was in good condition, with no signs of impact damage.

    (See photograph of "Additional view of crash protected module with beacon attached.")

    The internal solid state memory devices are encapsulated in a foam material for this model of FDR. The foam-encased memory module was relatively dry and undamaged.

    (See photograph of "Internal solid state memory module encased in foam.")

    As a precaution, a new ribbon cable connector was spliced onto the memory module and the module was placed in one of the TSB's F1000 bench units for downloading. Power was applied to the memory module and the data was successfully recovered and copied into the TSB's computer systems.

    The TSB's Recovery Analysis and Presentation System was used to recover the entire memory contents, which included the accident flight and six previous flights. The recording was of good quality and contained no synchronization problems or data losses (prior to the end of the recording). The final seconds of recorded data, including a final partial sub-frame of data (a partial second), were recovered with the assistance of the recorder manufacturer. All of the data was converted into engineering units using the documentation provided by Swissair, SR Technics, Boeing, and Teledyne (the manufacturer of the flight data acquisition unit). The original parameter documentation listed two discretes that were not recorded on this aircraft:

    • Lavatory Smoke (not recorded on the FDR)
    • Cabin (Cargo) Smoke (only installed in cargo-configured aircraft)

    All recorded parameters were reviewed for the occurrence flight and the six previous flights. Flight recorder data for the entire flight that is considered relevant to this occurrence is presented in graphical format. (See Appendix A – Flight Profile: Selected Events in the report.) This covers the one hour and eight minutes from the take-off at JFK to the point when the recorder stopped.

    The time reference for the FDR data is in UTC, which is synchronized to the radar time unless otherwise noted. Heading data is depicted in degrees with respect to magnetic north. Recorded pressure altitude is presented in feet and refers to altitude asl, assuming standard sea level pressure of 29.92 in. Hg. Derived indicated altitude is presented in feet above msl, corrected for pressure, based on the altimeter setting used for the specified segment of flight. The DU configuration parameter was calibrated with a range of 0 to 63 units, consisting of 64 possible configurations as indicated by a DU configuration matrix. For example, a recorded value of 0 indicates a typical configuration corresponding to all DUs (1 to 6) turned ON, as follows: DU1 = Left PFD, DU2 = Left ND, DU3 = EAD, DU4 = SD, DU5 = Right ND, and DU6 = Right PFD.

    FDR Anomalies

    Progressive anomalies were evident with some of the FDR parameters in the last minute of the recording, following level-off at approximately 10 000 feet. Some of the anomalies were determined to be fault codes, corresponding to either NCD or NDU (no DITS update). The parameters that recorded fault codes toggled between 0 and a specified value corresponding to the fault code. For 12-bit data, the decimal equivalents of the recorded binary fault codes were 1536 for NCD and 2304 for NDU.

    In the case of the NCD fault, it is the LRU that performs signal monitoring and generates the fault code. The NDU fault code is generated by the FDAU when it detects a loss of bus input.

    Cockpit Voice Recorder

    The aircraft's CVR was recovered by divers on 11 September 1998 in approximately 50 m of water. It was escorted to the TSB Engineering facility in Ottawa for analysis. The CVR was transported in distilled water to minimize oxidation from the exposure to salt water.

    (See photograph of "CVR immersed in water.")

    The CVR was an L3 Communications (formerly Loral/Fairchild) Model 93-A100-81, SN 25413, manufactured in September 1982. The 1/4 inch Mylar® tape has a nominal recording time of 30 minutes.

    The ULB for the CVR was intact and attached to the crash-protected memory module. The brackets containing the beacon were damaged substantially, but were still holding the beacon in place.

    (See photograph of "Close-up of ULB attachment.")

    The tape was intact, with no indication of tape damage. The tape was cleaned and dried with alcohol and placed on a reel for playback. A copy tape was made of the entire 32 minute, 27 second, recording. Several one- and two-channel digital audio files were made from the original four-channel recording to provide suitable combinations for analysis.

    (See photograph of "Endless loop 1/4 inch magnetic tape assembly immersed in water.")

    The CVR contained four separate tracks, which recorded the output of the two pilot's audio panels (one channel for each pilot), the observer's audio panel (where cabin interphone and PA had been selected) and the CAM. The TSB established a CVR Audition Group to transcribe the recording. Through voice recognition, breathing patterns while wearing oxygen masks, and crew activity, most voice communications could be attributed to specific crew members.

    The quality of the recording was fair. A few areas of interest were masked by VHF transmissions involving other aircraft, which emanated from an overhead speaker within the cockpit, particularly at the beginning of the recording, when VHF 1 or VHF 2 was selected by the captain on his communications radio panel. There was less VHF masking toward the end of the recording. Prior to their use of the oxygen masks, the pilots were not using intercom "boom" microphones to communicate to each other, so it was necessary to rely on the CAM channel to discern internal communications. Some communications were not discernable on the CAM channel owing to normal ambient noise and masking by external radio communications from the overhead cockpit speaker. The oxygen mask microphones were "hot" (always recording) to the CVR, but the crew had to activate a rocker switch in one direction to communicate internally and in the other direction to transmit externally over the VHF radio.

    Recorded cabin and cockpit conversation was mostly in Swiss-German, with some French and English spoken. The non-English words transcribed were documented in English, as translated by the Audition Group. Some of the translations from Swiss-German were affected by the context in which the word(s) were spoken. The CVR recording and transcript are privileged under the Canadian Transportation Accident Investigation and Safety Board Act.

    All CVR tracks were transcribed. There were a few unintelligible words and phrases that could not be deciphered or transcribed. Some of the radio traffic not related to the flight was not transcribed; however, all radio calls to and from SR 111 were transcribed. Only the captain's channel (P1) and the CAM channel contained VHF 2 radio traffic (Oceanic clearance frequency) and these were all to or from other aircraft. VHF 1 was used as the primary ATS radio.

    CVR Audition Group

    Because cockpit voice recordings are protected, only a few people were given access to the recording for the purposes of developing an accurate transcript and developing a factual summary of events. The US and Swiss accredited representatives to the investigation were asked to each nominate two members to the CVR Audition Group. Members were accepted by the TSB based on their expertise in one or more of the following areas:

    1. MD-11 aircraft or flight systems engineering
    2. MD-11 aircraft operations
    3. CVR expertise
    4. Familiarity with the voices of the flight crew members
    5. Fluency in English and Swiss-German

    Time Synchronization of FDR/CVR/ATS/Radar/FADEC

    During the initial examination of the FDR, prior to recovery of the CVR, the FDR arbitrary time reference was converted to UTC by matching pressure altitude from the Halifax radar data—which contained UTC time stamp information—with pressure altitude recorded on the FDR. The VHF keying data from the FDR was then compared with the ATS communications. The information on the FDR and ATS tapes was in agreement regarding the timing of radio communications. However, the specific UTC times recorded on the ATS tape differed from the UTC time obtained from radar data; ATS time was approximately 2.9 seconds ahead of radar time. UTC information on the radar was considered to be more accurate than information recorded on the ATS tape owing to the automatic updating of the UTC time stamp of the radar data. Therefore, radar UTC was used in the flight recorder analysis.

    When the CVR was subsequently recovered, the tape was played back on an open reel-to-reel playback deck at the normal playback speed of 1 7/8 inches per second and simultaneously digitized. Upon playback, it was found that the CVR recording was not playing at the correct speed, but was approximately 1.6% too slow, compared with the identical radio communications on the ATS tape. This was likely a result of a slight difference in playback speed when applying the nominal 400 Hz AC power to the TSB's playback hardware. Based on this information, the CVR recording was re-digitized to provide for playback at the correct speed. As with the ATS tape, VHF keying information from the FDR was then used to synchronize the FDR with the CVR recording.

    (See chart of "FDR/CVR synchronization.")

    Quick Access Recorder

    The QAR installed on SR 111 recorded six times the number of data parameters as the mandatory FDR. Consequently, there were many additional parameters of interest to the investigation. Many fragments of magnetic tape were recovered from the wreckage. Most of these fragments were from personal audio cassettes and video cassettes.

    (See photograph of "Magnetic tape recovered from SR 111.")

    Twenty-one segments of tape, identified by tape dimensions, were considered likely to have been from the QAR installed on SR 111. These fragments were between 1 and 117 inches (10 feet) long. The QAR used by Swissair is the Penny & Giles magnetic tape cartridge (digital ADAS recorder, or DAR). The bits are encoded and recorded on the tape using the MFM method. This is a different method than that used on FDR tapes. Some FDRs use Harvard Bi-Phase signals (Harvard Bi-Phase signals are used as a coding method to represent binary data as a waveform), where the signal transition widths are 1 and 2 times the clock period. With MFM, there are three widths: 1, 1.5, and 2 times the clock period. The 2 times transition width is only 33% wider than the 1.5 times transition width. With Harvard Bi-Phase, the 2 times transition width is 100% larger than the 1 times transition width. This means it is more difficult to distinguish the bit cell widths for the MFM signal. Also, when recovering the bit information from these signals, errors in detection can propagate, since decisions on what the bits are, depend on the values determined for previous bits. For example, a 1 times width can mean a binary 1 if the previous bit was a binary 1, or it can mean a binary 0 if the previous bit was a binary 0.

    The QAR records 384 twelve-bit "words" every second. This compares with normal tape-based FDRs, which record up to 64 twelve-bit words every second. The 384 words make up what is called a subframe; there are four subframes per frame, similar to an FDR. The QAR assembles two frames (8 seconds) as a block and surrounds this data with block status information, cyclic redundancy code checksum (error detection), and pre-amble and post-amble. The entire block is written to the tape and spaced apart with a dead signal, called the inter-record gap, to separate the records. Both the pre-amble and post-amble are 8 bytes. The block status is 4 bytes, while the checksum is 2 bytes. The data itself is 4 608 bytes, for a total of 4 630 bytes. There are normally four tracks of information. Because the tape had been recently changed, and because new tapes are bulk-erased, the data would expected to be found on only one track. A QAR tape with valid data was secured from Swissair to do tests with a "known quantity."

    The tape fragments were spliced onto one reel, with the recording sides wound on the inside of the tape. The tape was played back and digitized using a PC sound card, sampling at 48 kHz. The signal waveform was analyzed and data was found on 8 of the 21 fragments. The data was found on tracks 2 and 3. This was likely just one track, since there was no way of knowing the orientation of the tape when splicing. It was considered necessary to "reverse" one of the two tracks, in order to digitize in the correct direction. The fragments containing data ranged from 3 to 27 inches in length (which represents about 15 seconds of data).

    The manufacturer's equipment was tested to explore what capability was available to recover data from a known test tape and then from the occurrence aircraft tape. The method used required putting the tape in a QAR cartridge and then playing back the tape using the QAR hardware playback equipment. The manufacturer's equipment was able to retrieve data from the test tape but not from the accident tape using this method. Subsequent to this, an effort was made to recover data using software decoding methods available within the TSB's Recovery Analysis and Presentation System. A new algorithm was required for the MFM signal, since this format had not been dealt with before. Unfortunately, even for segments where the signal was somewhat recognizable, bit "timing" problems, as a result of possible stretching of the QAR tape, and problems with the amplitude of the waveform, made it possible to only decode occasional, even shorter streams of bits.

    (See illustration of "MFM signal from one of the tape segments, with varying amplitude.")

    The number of bits that could be contiguously decoded was insufficient to establish where the data was located with any data frame and was, therefore, impossible to transcribe into meaningful engineering units. Other segments contained an undecodable signal because of the severe distortion as a result of the crash trauma.

    (See illustration of "Bad MFM signal from one of the tape segments.")

    The test tape signal was decoded without problem using the TSB's software.

    (See illustration of "Decodable MFM signal from the test tape.")

    Circuit Breaker Study

    A number of clicks were audible on the CVR (and documented in the CVR transcript). Most of these clicks were considered normal cockpit sounds; however, a few were studied further, in an effort to determine whether the sound was a CB trip, given that the investigation had focused on the possibility of an electrical problem as the possible source of the fire. Factors that may have influenced the acoustic signature include the following:

    • The size and type of breaker;
    • The location on the panel, and on which panel;
    • A trip by ambient heat;
    • An electrical overload trip;
    • The background acoustic environment at the time of the trip;
    • The recording system (actual CVR versus cassette recorder);
    • The amplitude of the trip; and
    • The location of crew members obstructing the source.

    SR Technics conducted a series of ground and flight tests to develop a basis of sound for known CB trips under different conditions and for different sized breakers and locations on the various panels. The test data was created by the following three methods: pulling the CB by hand; tripping the breaker on the ground by overloading the CB; and pulling the circuit breaker with a string. Breakers were pulled with a string because it was felt that pulling with the human hand would likely dampen the acoustic response. It was not possible, on an in-service aircraft, to simulate a CB trip caused by high ambient temperature.

    In addition to the theoretical tests, a click was evident on the CVR in the second before the autopilot disconnect warbler. During a ground test, the autopilot CB was pulled by hand to determine the time lag between the breaker being pulled and the triggering of the autopilot warbler tone. The actual CVR had a 1.1 second lag, and the ground test had a 0.8 second lag. Both spectral sonograms and cross-correlation methods were used to try to determine objectively whether the click on the CVR prior to the autopilot disconnect was that of a breaker. Unfortunately, differences in aircraft, differences in recorder systems, the presence of background noise, and a lack of distinguishing characteristics make it impossible to state with certainty that the click was related to the tripping of a CB. Nevertheless, as the timing is very close and the click sounds like a CB trip, the click on the CVR just prior to the autopilot disconnect may be the result of a CB trip.

    Several other clicks were studied, using both spectral sonograms and cross-correlation methods, to determine whether any clicks could be attributed to a CB trip. Particular attention was paid to the time before the crew noted the smell in the cockpit, which might have provided clues regarding the source of ignition of the fire. The majority of the clicks were quickly ruled out owing to their similarity to known sounds, such as the movement of cutlery or transmission microphone clicks at the start and end of transmissions.

    At 0107:06, approximately 3.5 minutes before the crew noted the smell in the cockpit, a sound was recorded that was the subject of study because of its timing and its subjective acoustic resemblance to the click just before the autopilot disconnect. Unfortunately, objective methods such as sonograms and cross correlations were again unsuccessful in confirming the source of the click.

    FDR/CVR Stoppage

    The FDR and CVR stopped recording, approximately 5.5 minutes before the impact with the water, owing to a loss of electrical power while the aircraft was at a pressure altitude of approximately 10 400 feet and heading in a southerly direction. The relative stopping times of the FDR and CVR provide some clues regarding what system, failure or failures may have stopped the recorders.

    The FDR was powered by the 115 V AC Bus 3. The CVR was powered by the right emergency 115 V AC bus. Both buses are fed from 115 V AC Generator Bus 3. The FDR data indicates that a brief power interruption to the FDAU occurred less than two seconds before the FDR stopped. A warm start re-initialization (re-boot) of the FDAU followed the power interruption. The CVR also showed a discontinuity in the recording within two seconds of the CVR stopping. These interruptions and discontinuities introduce variability in the relative timing between the two recordings and, consequently, the precise stop times.

    Estimates of the FDR and CVR relative stop times were based on an analysis of the FDR data at the time of the FDAU re-boot and the CVR discontinuity.

    FDR Stoppage Time

    Analysis of the last seconds of recorded FDR data indicate that power to the FDAU was interrupted. The FDR lost synchronization after word 54 of subframe 3, which corresponds to a time of approximately 0125:39.8. Two words containing 1s and 0s were then recorded, followed by 27 words, most of which contained only 0s. The FDR then regained synchronization, repeating subframe 3, although with updated values. The frame counter was incremented by one, and the recording continued for another partial subframe of 22 valid words (duration of 22/64 of a second), after which the recorder stopped. It was determined that a brief power interruption to the FDAU had occurred between word 54 and the pattern of 0s. When the FDR loses signal input from the FDAU, it continues to record for up to two words (duration of 2/64 of a second), based on tests carried out by the FDR manufacturer.

    The FDR will coast through a power outage of up to 400 milliseconds, during which time no recording will take place, even though the recorder is still up and running. When power was restored, a FDAU re-boot was initiated, as indicated by the 27 words of 0s (a duration of 27/64 of a second). The re-boot was considered to be a warm start, in that 0s were recorded without a resetting of the frame counter. A warm start re-boot implies a power interruption of anywhere between 10 and 400 milliseconds. The actual duration of the power interruption was not determined. However, it was most likely at least 2/64 of a second long, in order to have recorded the two non-zero words, representing a loss of FDAU signal. Therefore, following the loss of the FDAU signal, there was no recording of data for a maximum period of up to 0.37 seconds (0.4 minus 2/64).

    Based on the pattern of the re-boot and the possible duration of the power interruption, the FDR stopped recording between 1.8 and 2.2 seconds after the FDAU power interruption (see above). The time of FDR stoppage would therefore be somewhere between 0125:41.6 and 0125:42.0.

    (See illustration of "Diagram depicting possible FDR stop times following FDAU re-boot.")

    CVR Stoppage Time

    The digitized CVR recording, after time correction, was approximately 32 minutes and 27 seconds long. The arbitrary time reference was converted to UTC (based on FDR and radar information), with the end of recording at approximately 0125:41.4. This stoppage time does not take into account any possible power interruptions that may have occurred during the CVR recording, which would increase the stoppage time. No obvious power interruptions were noted. In addition, the conversion of the CVR arbitrary time to UTC by synchronization with the FDR, has a maximum error band of plus or minus one second, owing to the one-second sample rate of VHF keying. A simultaneous discontinuity in the two radio channel signals, of 13 milliseconds, was noted at 0125:40.1. There was also a significant 400 Hz presence for approximately 80 msec immediately following the discontinuity on the copilot's radio channel. This 400 Hz signature was also simultaneously present on the observer's (PA) audio channel.

    (See illustrations of "Amplitude/time signatures of first officer and CAM channels near end of CVR recording" and "Amplitude/time signatures of captain and PA channels near end of CVR recording.")

    Inputs from the captain's and copilot's microphones were lost from the time of the discontinuity to the end of the recording. An attempt was made to determine whether the discontinuity was the result of a power interruption to the CVR. Based on the synchronization used, the time of the discontinuity on the radio channels occurred approximately 0.3 seconds after the time of the FDAU power interruption. It is possible that the CVR discontinuity and FDAU power interruption were related to the same event and therefore occurred at the same time, with the synchronization in error of approximately 0.3 seconds.

    The manufacturer of the CVR performed tests on the same model of recorder to characterize the amplitude/time signature of the signal during a power interruption. A signal input of 1 kHz was recorded on all four channels, and a power interruption of 80 milliseconds was applied. The signature was compared for any similarities with the discontinuity and 400 Hz signature observed on the occurrence CVR. The test revealed a distinct roll-off in amplitude when the power was interrupted, and there was evidence of amplitude modulation for a 200 msec when the power was restored.

    (See illustration of "Amplitude/time signatures of 80 msec power interruption applied to a test CVR.")

    The test signature did not appear to be similar to the discontinuity on the occurrence CVR, as depicted above. Since all four channels and the bias oscillator are powered by the same source, a power interruption would likely affect the four channels simultaneously. The occurrence signatures from the four tracks, however, were dissimilar. The CVR has a test capability that, when activated, records a 600 Hz test tone sequentially on all four channels. The tone is also recorded on normal start up and would be expected to be generated following the restoration of power after a power interruption. The test tone was not evident on any of the CVR channels on the occurrence recording. Based on the available information, it does not appear that a power interruption to the CVR occurred at the time of the discontinuity and 400 Hz signature, or at any other time during the recording. It is more likely that the two radio channels and possibly the remaining channels on the occurrence CVR experienced some form of electrical interference at the end of the recording.

    Relative Stoppage Times of FDR and CVR

    The relative stop times of the FDR and CVR depend on two unknowns, primarily the duration of the FDAU power interruption and the time synchronization. From the synchronization, the FDAU power interruption and the CVR discontinuity were 0.3 seconds apart. Since there is a tolerance of plus or minus one second on the synchronization, and it is possible that one event may have caused the FDAU power interruption event and the CVR discontinuity, it could be assumed that the power interruption and discontinuity were coincident. If the two recordings were synchronized using this point, then the CVR stopped at least half a second before the FDR. The synchronization point using VHF keying (used as the reference for the investigation) and the synchronization point that assumes the power interruption and discontinuity were coincident suggest that the FDR and CVR did not stop simultaneously. However, because it could not be determined whether the power interruption and discontinuity were coincident, and there is a tolerance in the VHF keying synchronization method, it is also possible that the FDR and CVR stopped simultaneously.

    (See illustration of "Relative stop times of FDR and CVR depicting overlapping stop windows.")

    Possible Causes for Premature Stoppage of Flight Recorders

    The crew had referenced the CABIN BUS switch, which is the first item on the Swissair Smoke/Fumes of Unknown Origin Checklist. The checklist also requires rotating the SMOKE ELEC/AIR selector sequentially into three possible positions (3/1 OFF, 2/3 OFF and 1/2 OFF), pausing at each position to see whether the smoke diminishes. Each position turns off the associated electrical and pneumatic system (one third of each system). Selection of the 3/1 OFF position would stop both recorders at the same time, since the 115 AC Generator Bus 3 is taken off-line in the 3/1 OFF position.

    The SMOKE ELEC/AIR selector is believed to have been fully rotated through the various positions during the final minutes of the flight. For the flight recorders to have stopped through the use of the SMOKE ELEC/AIR selector, either the selector remained in this position for the remainder of the flight (which it did not) or other multiple failures occurred simultaneously.

    The flight data revealed that the ADC-1 was not reporting to the FDR; that is, NDU was recorded about half a minute before the flight recorders stopped. The radar data, sampled approximately once every five seconds, showed that the Mode C (altitude information) from the transponder was also lost at about this time. If ADC-1 was supplying the transponder in use (typically ATC-1 for odd flight numbers, as was this flight) with Mode C altitude information, then the loss of Mode C would be expected when ADC-1 went NDU. The loss of ADC-1 would also have caused the captain's primary flight display to show Xs in place of air data parameters, if ADC-1 were the source in use. At this point in the flight, the copilot was flying the aircraft and the captain was troubleshooting. The CVR indicated that the copilot's electronic flight instrument displays then went blank, about 8 to 9 seconds before the flight recorders stopped, and the copilot made a reference to having to use the standby instruments.

    About 9 seconds after the flight recorders stopped, the Mode C was restored. It is plausible that when the copilot's displays went blank and he was forced to use the standby instruments, the captain decided to restore valid air data on his electronic displays since he would have had no ADC-1 information. It would, therefore, have been reasonable to select ADC-2 as an alternate source of data for the captain's displays. This action would account for the restored Mode C altitude, assuming ADC-2 was still functional. ADC-2 is on the right emergency 115 V AC bus, fed by Generator Bus 3, the same generator bus that powers the flight recorders and the first position of the SMOKE ELEC/AIR selector. This scenario implies that the SMOKE ELEC/AIR selector was not rotated and was not the cause of the flight recorder stoppage.

    Additionally, the FDAU exhibited a power interruption less than 2 seconds before the FDR stopped, whereas, on an other occurrence (Delta Airlines MD-11, N805DE, 9 October 1998), stoppage with the SMOKE ELEC/AIR selector in the 3/1 OFF position reportedly did not result in this characteristic. It is considered highly coincidental (and therefore unlikely) for a SMOKE ELEC/AIR selector action to have been made so close to the power interruption in the FDAU.

    Physical evidence from the wreckage also suggested that the numerous fuel pumps powered by Generator Bus 3 were operational at the time of impact with the water.

    The CABIN BUS switch was mentioned on the flight deck before the action was made to remove power to the cabin. Since the movement of the SMOKE ELEC/AIR selector to the first position is a significant action (compared to use of the CABIN BUS switch) affecting the operational status of the aircraft, it would be reasonable to also expect a verbal communication before that action was made. There was no verbal communication from either crew member with respect to operation of the SMOKE ELEC/AIR selector. In the seconds before the recorder stopped, when the copilot's displays went blank, it is possible that problems associated with the basic flight of the aircraft were escalating to the point where both crew members were focused on the task of flying the aircraft and restoring instrument display information.

    It is considered unlikely that the SMOKE ELEC/AIR selector was the cause of the recorder stoppage. The flight recorders probably stopped as a result of problems with the continuity of the electrical system.

    FDR Anomalies

    The parameters that recorded fault codes were associated with the following LRUs: FCC-1, FCC-2, DEU-1 and ADC-1. Each LRU performs signal monitoring; when a fault is detected the LRU generates an NCD fault code. For example, the FCC-1 contains monitors that can detect shorts to ground on input wires, open input wires, loss of excitation, or incorrect power phasing. Upon detecting any of these failures, the FCC-1 will flag the anomalous synchro output as NCD. The NDU fault code is generated by the FDAU when it detects a loss of bus input. The loss can be caused by a number of possible failures, including the opening of the input bus wire or the shorting-to-round of the input bus wire.

    According to the manufacturer, when a fault is detected by the FDAU, it will continuously output static data (no longer updated) for a specified time period, followed by the generation of the NDU fault code. The output of the fault code continues until the fault condition no longer exists. The last valid data (or NCD fault code, if FDAU was outputting NCD at initiation of NDU condition) will be generated for a count of four samples, prior to the output of the NDU fault code. Information from the FDAU manufacturer indicates that the duration of the static data is dependent on the subframe number being recorded at the time the fault occurs, and the sample rate of the parameter. For parameters recorded once per second, the duration of static data is estimated to be in the range of approximately 5 to 8 seconds. For parameters recorded once every 2 seconds, the estimated duration of static data is in the range of approximately 12 to 13 seconds. These durations are considered approximate; variations may exist. Analysis of the accident flight data indicated that some of the static data preceding the NDU output was generated for the expected duration, while other data did not match the estimated times. For those parameters (at varying sample rates) that recorded the NDU fault code and that were sourced from FCC-1, the period of static data ranged from approximately 10 to 16 seconds (most parameters were static for 12 to 13 seconds). For those parameters (at varying sample rates) that were sourced from ADC-1, the period of static data was approximately 6 to 7 seconds.

    The earliest parameter that recorded the NCD fault code was "Angle of Attack Right 2B", at approximately 0124:58. The parameter source was FCC-1 Channel B. Within the next 2 seconds "Spoil RT 5" and then "Flap ROB" also began to record the NCD fault code, also sourced from FCC-1 Channel B. According to the manufacturer of the aircraft, the FDAU receives output from channels A and B of FCC-1 only via the Channel A side. If a problem occurs with the Channel A side such that Channel A no longer processes Channel B data, the LRU will generate the NCD fault code for the unprocessed Channel B parameters. Since the sampling rates of the parameters were not the same, the different NCD start times were likely a result of sampling effects.

    The earliest parameter that recorded the NDU fault code was "Spoil LT 3", at approximately 0125:09. The parameter source was FCC-1. An additional 10 parameters also began to record the NDU fault code in sequence over the next two seconds. The difference in the sampling rates of the parameters likely accounts for the different start times of the NDU fault codes. The loss of primary power to FCC-1 Channel A would result in the loss of FCC-1 output to the FDAU and generation of the NDU fault codes. When primary power is lost, 1.5 seconds of back-up power is provided to the FCC Channel A side, during which time no data processing of the Channel B side occurs, resulting in the initial NCD fault code, which precedes the NDU condition. When considering the length of back-up power and the 12 to 13 second delay in recording the fault codes, during which time static data was recorded, the time of the FCC-1 Channel A loss was approximately 0124:57. None of the parameters from FCC-2 recorded fault codes during the last minute of the recording, suggesting that FCC-2 was functional up to the time of flight recorder stoppage.

    At approximately 0124:59.7, the first of two DEU-1 discrete parameters (FMA 2 - Vertical) changed from "Hold - White" to "No Display", indicating that the FMA display went blank. The second DEU-1 discrete (FMA 1 - Roll) changed from "Heading - White" to "No Display" at 0125:00.3. The DEU parameters require data from FCC-1 in order to display the associated FMA modes.

    The Computed Airspeed, Pressure Altitude, and TAT parameters recorded NDU fault codes at approximately 0125:14. These parameters were sourced from ADC-1. When considering the approximate 6 to 7 seconds of static data preceding the fault codes, it is estimated that a fault with ADC-1 occurred at approximately 0125:07. The ATC Transponder 1 is believed to have been in use, as Swissair procedures require that this system be used for odd-numbered flights (e.g., SR 111). The ATC Transponder 1 is normally fed from ADC-1. The loss of ADC-1 at the estimated time, based on the fault codes, is in agreement with the last radar Mode C return at 0125:06, before the Mode C was temporarily lost (Mode C was regained at 0125:50).

    Several discrete parameters recorded changes during the time the parametric data recorded fault codes in the last minute of the recording. Some of these changes in the discrete data represented anomalous or non-real events, likely occurring as a result of damage to electrical systems, as opposed to being the result of crew actions. In other instances, the changes were considered to be real events that occurred as a result of system-related damage. The first discrete parameter to indicate a change in status (that was considered to be a result of system-related damage) was FMA 2 - Auto Flight, which changed from "A/P 2 - Cyan" to "A/P 2 - OFF Red", indicating autopilot disconnection. This is considered to have been an actual event, as opposed to being anomalous. A review of the control surface deflections suggested that the disconnection was not a result of inadvertent manual control inputs by the crew. There was also no indication that the crew had intended to manually disconnect the autopilot. Radio communications with ATS following the autopilot disconnection suggested that the crew was forced to fly the aircraft manually. Furthermore, the autopilot warbler, which had begun to cycle at the time of the disconnection, continued to cycle to the end of the CVR recording. It would be reasonable to expect the crew to switch to the other autopilot and to try to silence the warbler. The fact that they were unable to use the other autopilot and unable to silence the warbler suggests that a fault in the system had caused the disconnection.

    The discrete parameter Yaw Damp. Lower 1A, provided from FCC-1, was the second parameter to indicate a change in status as a result of system-related problems. While the 1A channel of the lower yaw damper changed from "On" to "Off" at 0124:54, the 1B channel side remained "On" suggesting that the change was not a crew action, but a result of system damage.

    A failure associated with FCC-1 was consistent with the fault codes, and with the subsequent change in the FMA data to "No Display" (loss of FCC-1 information), occurring at approximately 0125:00. At approximately 0125:15, the four slat sensor parameters, normally provided from DEU-1, indicated what are considered to be anomalous or non-real changes in status, changing from "Retracted" to "Transit" for 25 seconds. These changes are considered anomalous, since there is no flight recorder data concerning aircraft behaviour to indicate that the slats had actually moved from the retracted position. Furthermore, the slat overspeed protection (284 KIAS threshold) would have inhibited slat extension at the 320 KIAS recorded at that time.

    At the time of the slat sensor changes, there was a further change in the FMA data that is considered an anomalous or non-real event. The recorded FMA data represents information presented on the captain's FMA displays. Under normal conditions, the captain's SOURCE SELECT switch (label 270) is set to DEU-1, and the recorded FMA data will be based on information from DEU-1. The FDR records the switch position; however, it does not record which DEU is providing information for the FMA data. The FDR recorded the captain's SOURCE SELECT switch as having remained in the DEU-1 position for the entire recorded flight. According to the manufacturer of the FDAU, when the FDAU detects failure of DEU-1 (failure of the bus activity test, which checks for a 1 second update of label 270), it then automatically outputs information from DEU-3 (auxiliary), following the recording of static data, although no specific fault code is generated. The switch to DEU-3 is not recorded on the FDR; the FDR only records the captain's DEU selection, which is retrieved from the selected DEU bus. The recording of anomalous data was likely a result of a failure associated with DEU-1, which is estimated to have occurred at approximate Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003

    Transportation Safety Board of Canada
    Symbol of the Government of Canada

     AVIATION REPORTS - 1998 - A98H0003

    Cockpit Seats

    1. Seats Description
    2. Captain's Seat
      1. Captain's Seat Examination
        1. Seat Base
        2. Seat Column and Carrier
        3. Seat Pan
        4. Seat Back
      2. Captain's Seat Determination
      3. Captain's Seat Belts Examination
      4. Captain's Seat Belts Determination
    3. First Officer's Seat
      1. First Officer's Seat Examination
        1. Seat Base
        2. Seat Column and Carrier
        3. Seat Pan
        4. Seat Back
      2. First Officer's Seat Determination
      3. First Officer's Seat Belts Examination
      4. First Officer's Seat Belts Determination
    4. Right Observer's Seat
      1. Right Observer's Seat Examination
        1. Seat Pan
        2. Seat Back
      2. Right Observer's Seat Determination
      3. Right Observer's Seat Belts Examination
      4. Right Observer's Seat Belts Determination

    Seats Description

    The captain's seat and the first officer's seat are constructed with mirror component parts, including the following mechanisms:

    • Seat controls that appear on the right side of the captain's seat pan appear on the left side of the first officer's seat pan.
    • The L-shaped track in the seat pan, which guides horizontal seat movement, is designed to move the captain's seat aft and then outboard to allow easier egress from the seat. The first officer's seat includes a duplicate mechanism on the opposite side.
    • The vertical rack on the seat columns and their corresponding pinions, located in the seat base, are on opposite sides in the captain's and first officer's seats.
    • The lap belt buckles are attached to outboard lap belts, on opposite sides of the captain's and first officer's seats.

    All three cockpit seats share the same armrest model. The left and right armrests are differentiated by unique PNs.

    (See illustration of "Captain's and first officer's seat design.")

    The right observer's seat is designed to translate fore and aft and laterally, and to pivot so that it can face forward, outboard, or remain in any of four intermediate positions. For horizontal adjustment, the right observer's seat is manually operated, whereas the captain's seat and first officer's seat can be manually or electrically operated. For vertical adjustment, all three seats can be operated manually or electrically. The appearance of the right observer's seat pan horizontal position adjustment mechanism is significantly different from that of other seats. The seat pan of the right observer's seat is fixed to metal tubes that slide within the carrier to allow this horizontal travel. Bearings within the carrier allow the tubes to slide smoothly. The seat is designed so that it can pivot only when it is in the fully aft and left position.

    (See illustration of "Right observer's seat design.")

    Captain's Seat

    Captain's Seat Examination

    The examination of the captain's seat did not include an examination of the seat cushions or coverings because they were not recovered.

    Seat Base

    The captain's seat base was identified by the location of the seat vertical drive pinion, which is on the left hand side in the captain's seat base and on the right hand side in the first officer's seat base.

    (See photograph of "Captain's seat - base.")

    Seat Column and Carrier

    The captain's seat column and carrier were identified by default since the first officer's seat column and carrier had already been identified. The U-shaped clamps, which attach the seat pan to the carrier, were deformed in a direction consistent with the seat having been forced away from right to left.

    (See photograph of "Captain's seat carrier - end view.")

    When the damage to the forward tube is aligned with the carrier, its position is consistent with the seat being near the left end of its allowable travel. The position of the rear tube is consistent with the seat being near the right end of its allowable travel. Gouge marks were, however, observed on the right end of the rear tube. When these gouge marks were aligned with the carrier, their position was consistent with the seat being near the left end of its allowable travel. A bearing had also popped out of the right side of the carrier.

    (See photograph of "Captain's seat carrier - top view.")

    Seat Pan

    The seat pan was recovered in several pieces. It was identified by
    PN 2A134-0299 on the L-shaped track, which is unique to the captain's seat. The seat pan was also identified by its unique shape, which is a mirror image of the first officer's seat. Unlike the first officer's seat, the captain's L-shaped track exhibited no significant gouge marks at the rear of the L-shaped track. The forward end of the L-shaped track, however, exhibited much greater damage than that of the first officer's seat; neither the gear teeth nor one side of the channel section were recovered. The single straight track was recovered. Unlike the first officer's seat, no vertical dent was exhibited.

    (See photographs of "Captain's seat carrier - L-shaped track forward end" and "Captain's seat - straight track.")

    Seat Back

    The captain's seat back was identified by default, since the seat backs of the other two cockpit seats had already been identified. Fracture surfaces were matched to reconstruct the seat back. All seat back components were recovered except for the lower right lumbar adjustment pulley. Although the upper pulley was fractured, a portion of it was recovered still attached to the surrounding structure.

    The captain's seat armrest was identified by PN 1A134 0042EB, a right armrest. The right armrest was still attached to the surrounding metal structure. As the metal structure belonging to the other two seats was still attached to those seats, it was determined that the armrest could only belong to the captain's seat.

    Captain's Seat Determination

    Damage to the U-shaped clamps on the carrier is consistent with the seat having been forced from right to left. Gouging damage to the tubes that pass through the carrier is consistent with the seat being near the left end of its allowable travel at the time of impact. In addition, the popped out bearing from the right side of the carrier is consistent with impact forces forcing the seat from left to right. Since the seat could only have moved from left to right if it was originally on the left, it was determined that the seat was likely near the left end of its allowable travel at the time of impact.

    The design of the captain's seat is such that travel to the left is only possible in the egress position. This position at the time of impact is confirmed by the absence of gouge marks to the interior of the aft end of the L-shaped track and the greater degree of damage to the forward end of the L-shaped track compared to the first officer's seat. Damage to the seat tracks and the position of the carrier on the column are also consistent with the seat being in the egress position at the time of impact.

    The absence of bending in the straight racks in the captain's seat pan is consistent with the seat having been subjected to a comparatively lesser downward force than the first officer's seat. Although this may be a result of the absence of occupant mass, it may also be a result of the orientation of the break-up forces.

    A determination could not be made regarding whether the seat was occupied at the time of impact.

    Captain's Seat Belts Examination

    The right shoulder belt and inertia reel were not recovered. The left shoulder belt and inertia reel were still securely attached to the seat structure. There was no evidence of tensile overstress to the webbing, and no evidence of deformation to the metal end fitting.

    (See photograph of "Captain's shoulder harness and inertia reel.")

    The captain's negative g strap and right lap belt were identified by default since those from the first officer and right observer seats had already been identified. The captain's left lap belt was not recovered. Both belts had separated from the seat; part of the seat structure was still attached to the end of each belt. The webbing in both belts had not separated but exhibited some damage. The metal end fitting of the negative g strap was unbent. The metal end fitting of the right lap belt was also unbent, but was slightly twisted. The captain's seatbelt buckle was identified by default since those from the first officer and right observer seats had already been identified. The buckle was split open, and no belts were attached. The buckle's severe corrosion was attributed to its recovery from the sea over a year after the accident.

    (See photograph of "Captain's negative g strap and seat belt.")

    Captain's Seat Belts Determination

    The lack of damage to the single shoulder belt and to the metal end fitting at the end of the negative g strap, as well as the slight twisting only of the right lap belt is consistent with these belts not being fastened at the time of impact.

    First Officer's Seat

    First Officer's Seat Examination

    The examination of the first officer's seat did not include an examination of the seat cushions or coverings.

    Seat Base

    The first officer's seat base was identified by default since the captain's seat base had already been identified. The first officer's seat base was more severely broken apart than the captain's seat base.

    Seat Column and Carrier

    The first officer's seat column and carrier were recovered still attached, and were identified as part of the first officer's seat by the column PN 1A134-0474 (vs. 1A134-0473 on the captain's seat column). The U-shaped clamps were bent and fractured from right to left. The carrier position was consistent with the first officer's seat being near the left-most extent of its lateral travel. There were no gouge marks on the tubes. In addition, two bearings had popped out from the right side of the carrier.

    (See photographs of "First officer's column and carrier" and
    "First officer's carrier at near full left travel.")

    Seat Pan

    The seat pan was recovered in several pieces; only fragments were recovered. These items were identified by their unique orientation, as they are mirror images of the same components in the captain's seat.

    There were significant gouge marks near the end of the long leg of the L-shaped track. These gouge marks are approximately aligned with where the pinion from the horizontal drive assembly would be with the seat in the forward position. There were no similar gouge marks at the forward end of the L-shaped track where the pinion from the horizontal drive assembly would be with the seat in the egress position. A length of the gear-toothed rack had broken away, but the channel section was undamaged.

    (See photograph of "First officer's seat track (with gouging).")

    Vertical bends in the straight gear racks of the seat pan are aligned with the cross tubes in the carrier. When the seat pan position was aligned with this damage, the damage to the L-track aligned with the horizontal drive pinion.

    (See photograph of "First officer's seat pan - side view.")

    Seat Back

    The first officer's seat back was recovered in several pieces. Fracture surfaces were matched to reconstruct the seat back. The first officer's seat back was identified by PN 0A134-0027A ISS3 H27/172237. The first part of the PN, 0A134-0027A, identifies the part as a seat back, common to both the captain and first officer seats. The second part of the PN, 172237, is the SN of the seat back unit, identified by the seat manufacturer (IPECO) as part of seat serial 18169. Swissair records confirmed that the first officer's seat was part of serial 18169. All four lumbar adjustment pulleys were recovered intact and attached to their surrounding structure.

    First Officer's Seat Determination

    The position of the carrier on the column is consistent with the seat being at near full left travel at the time of impact. There were no gouges on the tubes to suggest that the seat had been driven from right to left by impact forces. The two popped out bearings from the right side of the carrier are consistent with impact forces forcing the seat from left to right. Since the seat could only have moved from left to right if it was originally on the left, it was determined that the seat was likely at full left travel at the time of impact. Damage to the U-shaped clamps on the carrier is consistent with the seat having been forced from right to left.

    Damage to the interior of the L-shaped track on the seat pan is consistent with damage caused by contact with the horizontal drive pinion during impact. The location of the damage is consistent with the seat being in the forward position at the time of impact. The design of the first officer's seat is such that full left travel is only possible if the seat is in the forward position.

    The vertical bend in each of the straight tracks on the seat pan is consistent with a downward force pushing the track onto the horizontal support tubes in the rear carrier. It was determined that the first officer's seat had been broken away by a force with a significant vector component acting from right to left. It was also determined that the first officer's seat had also been subjected to a vector component that pushed the seat downwards.

    First Officer's Seat Belts Examination

    The first officer's left lap belt was identified by PN 2A134-0968A on the seat structure attached to the belt.

    (See photograph of "First officer's left lap belt.")

    The anchor fitting was still firmly attached to the seat pan structure. Damage to the webbing was limited to a small tear. The metal end fitting that fits into the buckle was bent.

    The right lap belt was identified by the unique appearance of the buckle with respect to the seat attachment fitting; the buckle is always attached to the outboard lap belt and is a mirror image of the captain's belt. The anchor fitting had torn from the seat pan structure. Damage to the webbing was limited to a small tear. The metal end fitting that fits into the buckle was bent. The end of the metal end fitting of the negative g strap was fractured and trapped in the buckle.

    (See photograph of "First officer's negative g strap fitting.")

    Both shoulder belts and the inertia reel were still attached to the seat structure. Unlike the captain's shoulder belt, the first officer's shoulder belts exhibited webbing fractures. The location of the fractures is approximately consistent with the shoulder location of a typical occupant. The melting damage to the exterior fibres at the fractured ends of the shoulder belts was spread over a long, thin region, and did not have the same concentrated circular appearance as the dripping melting damage to the right observer's lap belt.

    (See photographs of "First officer's left and right shoulder belts (lower pair)" and "First officer's shoulder harness straps.")

    First Officer's Seat Belts Determination

    The small tears in the webbing of the left and right lap belts is consistent with them having been in contact with torn metal.

    The fractured webbing on the left and right shoulder belts is consistent with damage resulting from an overload failure. The cause of the melting damage to the fractured ends of the shoulder belts could not be determined. This damage, however, is consistent with exposure to heat generated during rapid movement. The tearing of the strap is consistent with exposure to high tensile stress during an almost instant deceleration.

    The bent metal fittings of the lap belts and the fractured metal fitting of the negative g strap are consistent with the seat having been occupied, with all five belts fastened, at the time of impact.

    Right Observer's Seat

    Right Observer's Seat Examination

    The examination of the right observer's seat did not include an examination of the seat cushions or coverings.

    Seat Pan

    The right observer's seat pan was recovered generally intact, and was identified by its unique appearance. The position of the right tube with respect to the seat pan was consistent with the seat being at the aft end of its travel. There were no gouge marks on the surface of the right rear lateral tube. The position of the left tube with respect to the seat pan was consistent with the seat being well beyond the aft end of its allowable travel. The surface of the left tube exhibited gouge marks at locations consistent with the location of the bearings along the tube when the seat is at the aft end of its travel.

    (See photograph of "Right observer seat tube gouges.")

    The position of the lateral tubes with respect to the seat pan was consistent with the seat being near the left end of its travel. The right rear lateral bearing had popped out of the carrier. There were gouge marks on the right forward lateral tube. No gouge marks were exhibited on the right rear lateral tube.

    (See photograph of "Right observer's seat - right rear lateral bearing.")

    There was a significant gouge mark in the rightmost locking hole of the lock ring at the top of the seat column, which could only have been made with the locking pin in this hole. The position of the gouge mark is consistent with the seat facing forward at the time of impact.

    (See photograph of "Right observer's seat - seat column gouge mark.")

    The right observer's seat was recovered in the fully aft and left position.

    Seat Back

    The right observer's seat back was recovered in several pieces. Fracture surfaces were matched to reconstruct the seat back. This seat back was identified by default since the captain's seat and first officer's seat do not have the two metal reinforcing straps found on the right observer's seat. The inertia reel unit, including the shoulder belt, was not recovered. The three lumbar adjustment pulleys were still attached at the lower end of the seat back. The single lumbar adjustment pulley was fractured at the upper end of the seat back; only part of its mounting bracket was recovered, still attached to the seat back structure.

    Right Observer's Seat Determination

    The position of the seat pan along the fore and aft sliding tubes corresponded to the seat being in the fully aft position. If the seat had originally been in any other position prior to impact and had been subsequently forced to this fully aft position, the forcing of the tubes through the bearings in the carrier from their original position to their final position would have created notable gouge marks. The only gouge marks on the tubes were identified at locations consistent with where the tubes pass through the carrier when the seat is fully aft. The damage is therefore consistent with the seat being in its most aft position at the time of impact.

    The position of the seat pan along the sliding tubes corresponded to the seat being almost fully left. If the seat had originally been in any other position prior to impact and had been subsequently forced to this almost fully left position, the forcing of the tubes through the bearings in the carrier from their original position to their final position would have created notable gouge marks. No such gouges were observed. The popped out bearing is consistent with the seat being forced from left to right. The seat could not have been forced from left to right unless it was originally on the left. The damage pattern on the two lateral tubes is consistent with the seat being in its most left position at the time of impact.

    It was determined that the right observer's seat was in the fully aft and fully left position and was facing forward at the time of impact. In this position, the seat could have pivoted in any of its six allowable positions.

    Right Observer's Seat Belts Examination

    The two lap belts and the negative g strap were still attached to the seat but were not fastened. All three belts were firmly attached to the seat pan structure at their anchor points, with no evidence of overstress damage at any of these points. None of the metal fittings on the belts exhibited any plastic deformation or bending. The webbing on all three belts was heavily stained, but exhibited no indications that they had been subjected to a high tensile stress. The right lap belt exhibited some puncture damage to the webbing. The left lap belt also exhibited some melting damage, approximately 0.75 inches in diameter, concentrated in a discrete circular pattern.

    Right Observer's Seat Belts Determination

    The puncture damage to the webbing of the right lap belt is consistent with the webbing having been in contact with sharp metal. The cause of the melting damage to the left lap belt was not determined. The absence of overload stress damage to the lap belts is consistent with the lap belts not being fastened at the time of impact.

    There was insufficient evidence to prove whether the seat was occupied at the time of impact.

    Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
    Transportation Safety Board of Canada
    Symbol of the Government of Canada

     AVIATION REPORTS - 1998 - A98H0003

    Wreckage Recovery

    1. General
    2. Operational Phases
      1. Phase I – SAR
        1. Recovery Methods and Operations
        2. Personnel
      2. Phase II – Initial Search and Recovery
        1. Recovery Methods and Operations
        2. Equipment
      3. Phase III – Deliberate Search
        1. Recovery Methods and Operations
        2. Equipment
      4. Phase IV – Deliberate Recovery
        1. Recovery Methods and Operations
        2. Personnel
      5. Phase V – Heavy Lift Recovery Operations
        1. Recovery Methods and Operations
        2. Equipment
        3. Personnel
      6. Phase VI – Site Cleanup and Recovery Operations
        1. Scallop Dragger Operation
        2. Site Security, Survey, and Specialized Recovery (CCGS Parizeau)
        3. Accident Site Survey
        4. Wreckage Recovery Using CFAV Endeavour and DSIS ROV
        5. Suction Hopper Dredging
        6. Debris Sifting
    3. Summary
    4. Investigation Participants and Roles
    5. Main Equipment Assets

    General

    Immediately after the accident, many government departments, agencies, companies, and concerned citizens assisted in the search and recovery of victims and aircraft components. Civilian vessels from the local communities that were positioned offshore near the accident site also responded in great numbers. The close proximity of the LKP (as derived by radar) of the aircraft to Halifax meant that resources were available locally to permit an intense, multi-level government response. Canadian Forces ships were already at sea nearby; and Canadian Forces aircraft, medical teams, and army units quickly responded. Members of the RCMP, CCG personnel, a team from the BIO, and a team from the CHS were quickly on the scene. Because of its SAR responsibilities, major disaster response role, and the size and nature of its assets, the DND was the most appropriate agency for command and control of the initial marine operation. The MOC in Halifax became the shore-based centre for command, and on-scene command responsibilities were assigned to the captain of the HMCS Preserver, the largest and most suitable ship at the accident site.

    Initially, the vessels proceeded toward the aircraft's LKP. Surface debris was found slightly southwest of the LKP. Search efforts were focused in the areas with the greatest concentration of surface debris. It became evident to the first responders that the extensive destruction of the aircraft left little hope for survival of the occupants.

    Operational Phases

    The DND quickly developed Operation Persistence, an operational response plan for their support activities. This plan became the framework for resource planning and SAR coordination, and for the early recovery activities of the other agencies. Investigation activities were conducted by three agencies: the OCME, the RCMP, and the TSB. In fulfilment of their SAR responsibilities, the DND took the lead role for the initial overall maritime response. With input from the investigative agencies, senior DND staff directed the planning and coordination of resources to meet the needs of the various parties involved in the initial sea recovery operations. Daily coordination meetings were held in the MOC to ensure that information was exchanged among all parties, and to ensure that priorities and issues raised by all parties were addressed. Once it was determined that there were no survivors, the TSB, the RCMP, and the OCME jointly established priorities for the early wreckage recovery. The DND adopted a coordination role, providing personnel, equipment, logistical and organizational support to the investigation agencies.

    Operation Persistence was divided into six phases, as outlined below. These phases, while developed under the auspices of the military plan, remained the framework under which all site operations were completed.

    Table: Operation Persistence Phases

    Operational Phases
    Phase I SAR
    Phase II Initial Search and Recovery
    Phase III Deliberate Search
    Phase IV Deliberate Recovery
    Phase V Heavy Lift
    Phase VI Site Cleanup

    Phase VI, Site Cleanup, was coordinated and contracted by the TSB. This phase was primarily completed by civilian companies contracted to accomplish the work under the direction and control of the TSB and the RCMP. The Canadian Forces, the CCG, and the RCMP maintained a secure exclusion zone for this period.

    Phase I – SAR

    Recovery Methods and Operations

    When SR 111 disappeared from radar, the Moncton ACC advised the Halifax RCC. The RCC subsequently assigned SAR resources from the DND and the CCG. The Moncton ACC also tasked a civilian aircraft that was in the area to fly over the LKP within minutes of the accident.

    An intense search was conducted through the night as more search resources from the DND, the CCG, and local fishers arrived on the scene. The search was focused in areas in which the surface debris appeared to be concentrated. It was determined that these areas were considerably west of the actual location of the aircraft at the time of impact. The amount of debris in those areas was attributed to debris that had surfaced from submerged wreckage and drifted away from the accident site as a result of prevailing water currents.

    Personnel

    An on-scene advisory group was formed and deployed to assist field operations. The group included the following four members:

    • The TSB SGC, a scuba diver and SSS, and underwater acoustic locating equipment operator.
    • A DND officer (Navy), a clearance diver and Commanding Officer of the FDU(A).
    • Two members of the RCMP, one assigned to escort and security duties for transporting the aircraft flight recorders, if and when they were recovered; and a scuba diver in charge of a URT.

    All members had significant underwater search and salvage experience. As no member of the OCME was available to join the group, it was agreed that the OCME would be consulted for input on issues as required. The group was named "G3" to reflect the membership of representatives from the three government agencies represented. The G3 provided a single point of contact to ensure that technical input could be rapidly obtained in an integrated manner from representatives of the government investigative agencies and the DND. The G3 addressed a myriad of investigation issues aimed at optimizing search techniques and diving operations.

    Phase II – Initial Search and Recovery

    Recovery Methods and Operations

    During the first days after the accident, the search for the aircraft wreckage was concentrated in those areas with the greatest concentration of surface debris. As both aircraft flight recorders, the CVR and the FDR, were fitted with ULBs, an underwater acoustic search was implemented to locate them. The HMCS Okanagan, a Canadian Forces submarine, was assigned to supplement the acoustic search on 3 September 1998. This proved a difficult task in some locations owing to factors such as rock outcrops, which created shallow water regions that posed navigation hazards. The shallow water areas were often noisy environments that reduced signal detection ranges, making signal analysis difficult. These areas also created potential signal blind spots. Because it was focused in areas with the greatest concentration of surface debris, the search was initially unsuccessful. It was during transit away from this area on 5 September that the submarine detected a ULB acoustic signal and accurately established the flight recorders' probable location. Upon reception of the ULB signal, navy divers were rapidly outfitted with CUMA diving equipment and deployed to the identified location.

    Detailed underwater mapping was conducted to locate all parts of the aircraft. The seabed beneath the aircraft track was subsequently searched by use of scanning equipment and divers to determine whether any debris had fallen from the aircraft. The size of the search area and the nature of the ocean bottom posed several challenges, and required the use of specialized equipment.

    The Remote Sensing Group, Emergencies Sciences Division, EC, conducted several tasks, including searching for and analyzing fuel slicks on the ocean. The release of fluids from the wreckage, such as fuel, would help identify the location of submerged debris. This information, gathered by a Convair 580 aircraft and a Douglas DC-3 aircraft outfitted with airborne scanning equipment, was used to help assess whether the aircraft had crashed at a single point of impact, or whether it had broken up in stages and had been deposited over a larger area.

    The coastal land areas that the SR 111 aircraft had overflown were also searched for parts that might have been shed from the aircraft and also for evidence of jettisoned fuel. An investigation of the jettisoned fuel was initiated since the flight recorders had ceased to function approximately six minutes prior to impact and it was unknown whether the aircraft had dumped fuel. Stereo aerial survey photographs (near-colour infrared and panchromatic) were taken to search for potential evidence of vegetation stress from the effects of fuel deposits or as a consequence of fallen parts. These photographs were also taken to help assess witness vantage points, and for the potential creation of orthophotomaps for land search operations. SPOT satellite imagery of the scene was also obtained for this purpose. All site information was input and related to other data in the TSB GIS.

    The CUMA divers precisely homed in on the ULBs, which although battered, had remained attached to the flight recorders. Owing to the ocean depth and other factors, dive times were restricted to approximately 10 minutes. In addition to being arduous, the task was also dangerous. The dives were conducted in cold water, in low light, and among entangled piles of aircraft debris with many protruding, razor-sharp edges.

    Equipment

    The HMCS Okanagan provided an efficient means of sweeping large areas where sufficient water column depth permitted.

    (See photograph of "HMCS Okanagan.")

    The CUMA diving set is a lightweight, closed-circuit re-breather system that produces few bubbles. The CUMA set allowed the divers to quickly conduct relatively deep dives with reduced risk of decompression illness. The set also allowed divers to dive again after only a few hours, a much shorter decompression time than that required by traditional equipment. The CUMA divers used portable, hand-held underwater acoustic locators to precisely home in on the ULBs.

    Features such as the irregular topography of the ocean floor and rock outcrops and cobble caused aircraft debris to blend into its surroundings when viewed using conventional sonar search equipment. To optimize detection, assist in target classification and identification, and rapidly sweep areas efficiently, equipment such as dynamically-focused, multi-beam, SSS equipment was used at high-tow speeds. This equipment provided large area coverage with superior resolution and image clarity. This information was integrated with a high-resolution, multi-beam echo system that generated a detailed three-dimensional bathymetry model of the ocean floor. Differential satellite global positioning systems were used for accurate navigation and surveillance. The high-resolution, SSS and bathymetry data formed the foundation upon which all ongoing and future underwater operations were conducted. Computer modelling for ocean currents at various depths in the water column was also used to supplement this data. This modelling was used to help determine the origin and destination of surface debris. A DTM of the ocean floor and coastal land areas was ultimately created, related, and compiled with other important information into the TSB GIS.

    The Convair 580 aircraft was used to quickly search the ocean surface for fuel slicks using Synthetic Aperture Radar. Synthetic Aperture Radar, an active sensor, generated images that allowed searching for debris and slicks day or night, through fog and bad weather, as required. The specially equipped, slower flying Douglas DC-3 aircraft worked in concert with the Convair 580 aircraft. When the Convair 580 aircraft detected a slick, the DC-3 was dispatched to analyze the slick using an on-board LEAF. The LEAF was used to determine whether the slick was an unrelated pollutant, such as fuel from a ship (Bunker C fuel), or whether it was related to the missing aircraft (Jet A fuel). This information was also supplemented by Synthetic Aperture Radar imagery of the scene obtained from Canada's RADARSAT satellite. These aircraft were also used to search for shed aircraft parts and evidence of jettisoned fuel, and to take stereo aerial survey photographs.

    Phase III – Deliberate Search

    Recovery Methods and Operations

    The recovery of human remains was a high priority throughout the entire search phase. This effort was sustained along with other search and recovery objectives in the following areas:

    • Debris field, particularly in the identified location of the flight recorders
    • Final flight track
    • General search area surrounding the LKP
    • Areas where wreckage was anticipated to drift
    • Shoreline
    • Areas in which witnesses believed that the aircraft had flown or that flight evidence might exist

    In addition to the deployment of SSS equipment for the search and area mapping on 3 September 1998, the search included the following ongoing activities:

    • Surface search by Navy, RCMP, CCG and auxiliary vessels
    • Surface and shoreline search by military and CCG helicopters
    • Shallow water (coastal diving) searches by RCMP and military divers
    • Shoreline search by military and volunteer land search team members

    (See illustration of "Debris field - SSS picture.")

    Equipment

    Canadian naval divers switched from CUMA-equipped diving to surface-supplied diving on 9 September 1998 to allow for greater time on the bottom. ROVs were also deployed from two ships for searching and conducting very limited recovery operations; their recovery capability was restricted by their limited lift capabilities. Initially, these ROVs did not have a navigation or positioning system to provide accurate positioning information when a target was found. Navigation positioning systems were subsequently purchased and the ROVs were modified.

    Phase IV – Deliberate Recovery

    Recovery Methods and Operations

    The following four methods were first used to locate and collect wreckage outside the main debris area:

    1. Surface and shore retrieval
    2. SCUBA-facilitated searches (in coastal areas)
    3. Shallow water, CUMA, and surface-supplied diving searches
    4. ROV searches

    Owing to the water depth at the wreckage site, the limited deep-water recovery and salvage capability available, and the limited time frame within which recovery operations could be conducted before the North Atlantic storm season made recovery operations impractical, it soon became evident that additional recovery equipment would be required. The USN provided a salvage vessel of similar capability to that used in the TWA 800 wreckage recovery; the USS Grapple was assigned to assist. The ship arrived in Halifax on 11 September 1998, was prepared for sea, and began on-site operations on 14 September 1998.

    (See illustrations of "USS Grapple." and "Grapple search and recovery process.")

    The TSB also requested the use of the USN LLS equipment. This equipment, however, could not survey the site effectively at the depth required. As a result, it was decided to proceed with the recovery operation and conduct a sea bottom survey when other LLS equipment was available. Targets were identified and recovered using divers and ROVs. Canadian Forces divers were deployed alongside the USS Grapple. ROV and diver-helmet camera information was used to make technical assessments during this phase.

    (See photograph of "Three onsite ships.")

    On 3 September 1998, 12 Wing Shearwater provided two hangars: "A" Hangar and "B" Hangar. "A" Hangar was used for the reception and sorting of aircraft debris, while "B" Hangar served as a temporary morgue.

    Recovered aircraft debris was transported to the HMCS Preserver and then transferred to a jetty in Shearwater using CCG ships. Most of the material recovered early in the process consisted of surface debris, predominantly aircraft interior items and a few personal effects. Once on site, the USS Grapple began the recovery operation. After a preliminary freshwater rinse, the recovered wreckage was transported directly to the jetty at 12 Wing Shearwater by CCG ships. The material was received at the jetty in 12 Wing Shearwater, freshwater washed, and transported to "A" Hangar for identification, sorting, and storage and material layout.

    (See photograph of "Earl Grey Shearwater jetty.")

    Recovered human remains were transported to the HMCS Preserver, transferred to DND Sea King helicopters, and then flown to "B" Hangar.

    While the USS Grapple was moored over the main debris pile, the CCGS Matthew conducted an SSS search of the flight track the aircraft had flown just prior to the crash to determine whether there was any aircraft debris in these areas. No debris was recovered.

    On 30 September 1998, the USS Grapple left its moorings over the wreckage site and prepared for its return to the US.

    Personnel

    Approximately 150 Canadian DND and RCMP divers and 20 USN divers worked together during this phase. To assist in identifying debris targets, specialists from the TSB and selected advisors and observers were on board ships.

    Phase V – Heavy Lift Recovery Operations

    Recovery Methods and Operations

    After exploring several options for a higher volume method of recovery for the substantial amount of remaining wreckage, it was decided to contract a lifting vessel that used a large bucket to capture the aircraft wreckage from the underwater debris pile and lift it onto a barge moored alongside. The material was then freshwater washed, sorted, and transported to 12 Wing Shearwater on a CCG ship.

    Equipment

    A contract was let for the lifting ship, the Sea Sorceress, and a barge to be used as a platform to receive, wash, and sort the material. The Sea Sorceress used a dynamic positioning system to optimize its lift over the debris field. The ship also had an on-board ROV used to assess coverage and lifting effectiveness. A CCG ship, the Earl Grey, was used to transport the recovered material to Shearwater for further processing and examination.

    (See photograph of "Sea Sorceress with barge.")

    Personnel

    An officer from the CCG with salvage experience acted as project manager. The labour-intensive requirements of the effort required nine 10-person teams of RCMP, DND, and TSB personnel to support the 24-hour, 7-day-per-week operation. These teams were housed and supported ashore in a temporary base camp that allowed them to transfer to and from the barge before and after each shift. These support facilities were erected adjacent to a community centre in Blandford, Nova Scotia, by DND personnel in a matter of weeks. This operation was supported by many other companies and agencies, including local firefighters.

    (See photograph of "Blandford base camp.")

    TSB on-site coordinators remained on board the Sea Sorceress throughout the operation. The teams were transported for each shift by a small "taxi" craft that had been used to transport personnel during the construction of the Confederation Bridge. Approximately 1 000 transfers of people onto the barge were conducted during this phase of recovery operations. Facilities to support the teams (medical, food, decontamination, rest areas, etc.) were located on the barge. Recovered items were rinsed, sorted, prioritized, and prepared for shipment ashore in the wreckage reception area on the barge.

    Phase VI – Site Cleanup and Recovery Operations

    This operational phase was divided into the following chronological subphases:

    • Scallop dragger operation
    • Site security, survey, and specialized recovery
    • Accident survey
    • Wreckage recovery using CFAV Endeavour and DSIS ROV
    • Suction hopper dredging
    • Debris sifting

    Scallop Dragger Operation

    Recovery Methods and Operations

    The TSB contracted the Anne S. Pierce, a commercial scallop dragging ship owned and operated by Clearwater Fisheries, to recover aircraft wreckage from the ocean floor using a scallop drag net. Operations were conducted in the accident site area from 6 November 1998 to 12 January 1999. The crew sorted the debris as it was brought aboard after each drag.

    The winter weather and the high sea state limited the operation. These conditions, compounded by low temperatures and high winds, caused ice to form on deck making on-deck activity hazardous. In sea swells of 3 m or more, the drag net, suspended above the deck, swung unpredictably.

    (See photograph of "Anne S. Pierce.")

    Personnel

    Two TSB technical investigators and two members of the RCMP were aboard the Anne S. Pierce to provide technical investigation direction to the crew and to arrange for the appropriate treatment of sensitive debris, such as high-priority items of significant interest to the investigation, personal effects, and human remains. All aspects of the vessel operation and handling were carried out by the contracted 11-person fishing crew.

    Equipment

    The scallop drag net had an average opening of 2.5 feet below the rake and a chainmail net consisting of 3.5-inch rings (later modified to 2-inch rings) connected by 2-inch links. Fish tubs were used to store and transport the debris. Small tote boxes were used to transfer smaller debris.

    (See photograph of "Scallop net.")

    Site Security, Survey, and Specialized Recovery (CCGS Parizeau)

    Recovery Methods and Operations

    Beginning in mid-February and continuing until the end of March 1999, the CCGS Parizeau, equipped with "Videograb" equipment from the BIO and a small ROV from the DREA, collected site security and camera survey information about the debris field.

    Personnel

    Along with CCG personnel, members of the RCMP and TSB investigators were on board during these operations.

    Accident Site Survey

    Recovery Methods and Operations

    The TSB engaged CSR to carry out an LLS and an SSS survey of an area about 1 sq. nm around the accident site. The survey was conducted using the CCGS Earl Grey between 16 and 30 November 1998. Survey operations were conducted on a 24-hour basis, stopping only for inclement weather or mechanical failures. All activities pertaining to the safe operation and handling of the vessel and equipment were carried out by the CCG.

    CSR developed the survey plan based on a 1 sq. nm box surrounding the main debris area. The survey box was oriented so that the grid lines ran southwest to northwest and were spaced at 10 m intervals.

    It became apparent that the survey could not be completed within the allotted time frame owing to deteriorating weather. As a result, the survey focused on obtaining as much LLS information as possible within the main accident site and only sampled some peripheral areas. Because the SSS equipment could effectively survey a larger area than the LLS, grid lines were selected to allow the SSS to cover 100% of the survey area in the allotted time.

    The equipment's capability to provide high-quality data was severely limited by the weather. If the sea swells exceeded approximately 2 m, the movement of the ship made it difficult for the towed equipment to maintain a steady altitude above the sea bottom. Turbidity in the water resulting from storms and tidal movement, caused a dramatic reduction in the image resolution and quality. Wind also made it difficult to maintain the ship on a straight course.

    Equipment

    CSR supplied the survey equipment. All LLS imaging was recorded on videotape and the individual targets were captured as unique "frame grabs." All target locations were recorded and plotted onto either the side-scan mosaic or multi-beam background. The SSS was set to a 50 m range on each side and the captured data was available as individual line printouts or a complete mosaic.

    (See photograph of "Side scan sonar.")

    Personnel

    The LLS and the SSS survey were conducted by CSR operating personnel. Two TSB technical investigators were also deployed on board the ship to provide direction and guidance to CSR, as well as to monitor the data as it was being collected.

    Wreckage Recovery Using CFAV Endeavour and DSIS ROV

    Recovery Methods and Operations

    The wreckage and recovery operation using the CFAV Endeavour and DSIS ROV commenced on 26 April 1999 and continued until 14 July 1999.

    The results of previous operations indicated that most of the remaining debris lay in an area identified as the main debris field, an area surrounding the main wreckage site that was 50 m wide north to south and 125 m long east to west. Based on visual information gained from the previous operations, the team focused on clearing the main debris field of all visible debris and then expanded this operation to the surrounding area.

    Equipment

    The DSIS ROV, owned and operated by the Canadian Forces FDU(A), was used to recover aircraft wreckage from the ocean floor.

    (See photograph of "DSIS.")

    The CFAV Endeavour was leased for use as the operating platform. A smaller Phantom ROV was used as a survey and backup vehicle.

    (See photograph of "Endeavour.")

    To recover the smaller pieces, the team designed and built a basket that was carried by the DSIS manipulators. The basket had a lid to securely contain the buoyant materials. Midway through the operation it was decided that only debris larger than 30 cm (long or wide) would be retrieved since the draghead on the Queen of the Netherlands, the dredge ship that was intended to be used in the final recovery operation, was equipped with an integral screen that would prevent the retrieval of anything larger than 30 cm.

    Personnel

    The DSIS was deployed with six operating support personnel from the FDU(A) and three FSRs providing maintenance support from ISE. Two persons captured historical data of all subsurface operations in the form of maps and electronic data. A member of the RCMP was on board to secure the exclusion zone and to process recovered exhibits. A TSB investigator was also on board to serve as the coordinator and liaison for prioritizing recovery efforts and activities at sea, as well as to provide technical advice for handling all aircraft wreckage pieces.

    Suction Hopper Dredging

    Recovery Methods and Operations

    In March 1999, the TSB assessed various options to complete the site cleanup. It was discovered that the trailing suction hopper dredge, the QN, would be operating in Canadian waters at Terra Nova as part of the Petro-Canada Terra Nova Project. The QN's technology allows it to retrieve vast quantities of material from water depths of up to 140 m in a remarkably short time period. The Dutch firm Boskalis made the vessel available under contract near the end of September.

    (See photograph of "Queen of the Netherlands.")

    After undergoing three days of equipment modifications in St. John's, Newfoundland, the QN departed at 0800ADT (1100 UTC) on 26 September 1999 and arrived at the accident site at 2000 ADT (2300 UTC) on 27 September 1999. Extensive video coverage of the main wreckage field showed a seabed characterized by loose glacial silt, sand, and gravel. Seabed samples from this area showed aircraft debris intermixed with the loose bottom material, but not within the underlying clay bed. The dredging operation was subsequently focused on recovering only the loose materials. To this end, the bottom was dredged using a "sawing" method in which the ship first makes a single pass and then repositions itself for repeated parallel passes.

    The main debris area was dredged four times, to a depth of approximately 1.5 m. A video survey of this area showed little remaining debris. The adjacent secondary area, slightly east of the main area, was dredged twice to a depth of approximately 30 cm. A video survey of this area showed little disturbance to the seabed and no remaining debris. An adjacent tertiary area farther east consisted predominantly of bedrock. As the dredging operation proved ineffective in this area, it was only slightly dredged and was considered a lesser priority than the primary area. Dredging was stopped when the ship reached its maximum draft (i.e., water depth drawn by the ship when loaded), having collected approximately 8 500 m3 of recovered material.

    Dredging and pre- and post-dredge surveys were carried out on 28 and 29 September 1999, recovering approximately 8 500 m3 of material. Upon completion of the final survey, the dredged material was transported aboard the QN to the Sheet Harbour Industrial Port, Nova Scotia. This site was chosen to offload the dredged material owing to the appropriate depth of the harbour and the availability of a suitable containment area. A 2.5 m high containment dyke, fitted with an approved environmental liner and with an overall capacity of approximately 50 000 m3, was constructed on a five-acre site adjacent to the harbour. The construction of the dyke and sifting area and the supply of equipment and personnel were contracted through PWGSC to Dexter Construction. The QN arrived alongside the dock at 0830 ADT (1130 UTC) on 30 September 1999 and commenced offloading. Offloading continued for the next 26 hours, during which time all possible material was discharged. At this time, members of the RCMP and TSB personnel took a visual survey of the vessel's hopper and determined that no items of interest to the investigation remained.

    (See illustration of "Suction dredge operation.")

    Debris Sifting

    Recovery Methods and Operations

    The initial sifting and sorting of the dredged material was carried out at the Sheet Harbour site using various pieces of heavy equipment. On 5 October 1999, the TSB and contracted Dexter personnel collected all visible aircraft debris and personal effects from the surface of the material in the dyked areas. The remaining material was processed using mechanical screening equipment that separated the aircraft debris from most of the natural seabed or waste material. The non-waste material was moved from the separator on a conveyer belt, where contract personnel retrieved and sorted the items. This sifting operation started on 6 October 1999 and continued until 2 November 1999, when all of the dredge materials had been processed.

    (See photograph of "Debris sifting operation.")

    Site security was provided by the RCMP and consisted of an 8-foot wire fence with a single point of entry surrounding the entire dyke and sorting area. Video cameras mounted at key locations within the dyke and sorting areas, as well as on both of the conveyor systems, allowed the RCMP to monitor all activities.

    Summary

    The depth of the water and the undetermined point of impact in the initial stages of the search and recovery phase created substantial challenges. Despite these challenges, the high degree of cooperation and innovation, the multitude of available and effective resources, and a systematic and sustained approach lead to remarkable results. The early recovery of the flight recorders was a substantial accomplishment and significant milestone in the investigation. Extraordinary efforts by the dive teams sustained the recovery of human remains for the maximum possible time, which ultimately contributed to the successful identification of all those on board SR 111. During many of these activities, search and recovery personnel faced great challenges and uncommon personal risk. The operations were nevertheless completed without any serious injury.

    Despite new recovery challenges at each operational phase, almost 98% of the aircraft's structural weight was recovered.

    Investigation Participants and Roles

    Table: Investigation Participants and Roles

    Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
    Transportation Safety Board of Canada
    Symbol of the Government of Canada

     AVIATION REPORTS - 1998 - A98H0003

    Structures

    1. Empennage
      1. Horizontal Stabilizers and Elevators Examination
      2. Horizontal Stabilizers and Elevators Determination
      3. Vertical Stabilizer and Rudder Examination
      4. Vertical Stabilizer and Rudder Determination
      5. Empennage Overall Determination
    2. Wings
      1. Wing Skin Examination
        1. Left versus Right
        2. Top versus Bottom
      2. Wing Skin Bending Deformation
        1. Top versus Bottom
        2. Left versus Right
      3. Skin Torsional Deformation
        1. Top versus Bottom
        2. Left versus Right
      4. Wing Skin Determination
      5. Stringer and Shear Clip Damage
      6. Wing Spars Examination and Determination
        1. Forward versus Rear Spars
        2. Left versus Right
        3. Deformation
        4. Determination
      7. Wing Ribs and Bulkheads Examination and Determination
        1. Left versus Right
        2. Deformation
        3. Determination
      8. Slat Tracks Examination and Determination
      9. Pylon Attachment Fittings Examination and Determination
      10. Control Surfaces
      11. Wingtips
        1. Winglets
      12. Wing Overall Determination
    3. Cabin Outflow Valve Doors
      1. Cabin Outflow Valve Doors Examination
      2. Cabin Outflow Valve Doors Determination
    4. Cockpit Sliding Clearview Windows
      1. Description
      2. First Officer's Window Examination
      3. First Officer's Window Determination
      4. Captain's Window Examination
        1. Latch Plate
        2. Linking Arm
        3. Window and Sill
      5. Captain's Window Determination

    Empennage

    The stabilizers, elevators, and rudder from HB-IWF were examined to document the fracture and deformation patterns and, if possible, determine the aircraft attitude at the time of impact.

    This process was limited to those pieces greater than approximately four feet long. These larger pieces were expected to provide the clearest patterns showing the deformation of the structure as a whole. During the break-up sequence, localized buckling may have caused deformation in smaller pieces that is contrary to the deformation of the overall structure, which would be misleading. Since the salvage operation was thorough, especially salvage of the larger pieces, it is probable that most of the gaps in the reconstruction represent parts that had broken apart into smaller pieces.

    Horizontal Stabilizers and Elevators Examination

    Pieces of structure that were examined included pieces of elevator in the vicinity of hinge attachment fittings, pieces of stabilizer skin, operating bulkheads, and a length of front spar.

    The operating bulkheads are located at the innermost ends of the horizontal stabilizers.

    (See illustration of "Horizontal stabilizer section.")

    The two bulkheads were fractured, and both bulkheads were fractured at similar locations. The rear connection point of each bulkhead was still attached to a piece of aft fuselage structure, the piece of fuselage structure attached to the right bulkhead being the larger of the two.

    The single large piece of front spar that was recovered came from the inboard end of the left stabilizer. It had been bent aft. There was no conclusive evidence of any up/down bending deformation, or of any nose-up/nose-down twisting to this section of spar. The large pieces of elevator that were recovered were all located at hinge fittings. Each piece included the hinge fitting and the short length of the rear spar to which the hinge fitting was attached. Note the corresponding locations on the left and right elevators and their similar appearance.

    (See illustration of "Horizontal stabilizers and elevators.")

    No conclusive deformation or fracture patterns were observed in any of the elevator pieces that would indicate whether they had separated upward or downward, or that would suggest the position of the elevator at the time of impact.

    A large piece of the torsion box at the inboard aft end of the left stabilizer was still intact, with its upper and lower skins still attached. The lower skin was still attached to the operating bulkhead, but the upper skin had separated. No conclusive deformation or fracture patterns were observed in any of the skin panels that would indicate whether they had separated upward or downward, or whether they had twisted nose-up or nose-down. The ribs were bent outboard.

    Horizontal Stabilizers and Elevators Determination

    The general damage pattern between the left and right stabilizers showed significant symmetry.

    • The operating bulkheads broke at similar locations, and the rear of each bulkhead was still attached to a piece of aft fuselage structure. Pieces of stabilizer skin were still attached to the operating bulkheads.
    • Large pieces of stabilizer skin, similar in appearance, were found in corresponding locations on the left and right sides.
    • All that remained of both elevators were similarly sized sections located at the hinges; these hinges were still attached to similar short lengths of the rear spar.

    Despite the overall symmetry, the left stabilizer showed less severe damage than did the right stabilizer.

    • The torque box at the aft inboard end of the left stabilizer was still intact as a single unit.
    • The single large piece of front spar that was recovered came from the left side.

    The left main spar was bent aft, which is consistent with the stabilizer having been pushed aft by impact forces.

    The ribs in the surviving portion of the wing box in the left stabilizer had been bent outboard. Owing to the sweep-back angle of the stabilizer, and the fact that the ribs are perpendicular to the leading edge, outboard bending of the ribs is consistent with impact forces pushing the stabilizer toward the rear.

    No conclusive deformation or fracture patterns were observed that would indicate whether the stabilizers had separated upward or downward, or with nose-up or nose-down twist.

    Vertical Stabilizer and Rudder Examination

    The examination was limited to those pieces greater than approximately four feet in length, and located above the engine nacelle. Pieces examined were limited to pieces of the rudder, since no large pieces of the stabilizer were recovered. The rudder is constructed as four separate pieces: upper forward, upper aft, lower forward, and lower aft.

    (See illustration of "Vertical stabilizer and rudder.")

    The lower aft rudder was intact and relatively undamaged. The upper aft rudder was also intact, but was missing its uppermost quarter. The two forward rudders were severely damaged, and the upper forward rudder was missing its uppermost half. The leading edges were indented, and this damage favoured the left side.

    Vertical Stabilizer and Rudder Determination

    The aft rudders were still relatively intact; the forward rudders were severely damaged and no large pieces were recovered from the vertical stabilizer ahead of the rudders. This is consistent with impact from the front.

    The damage to the leading edge of the lower rear rudder favoured the left side, which suggests that the rudder was to the left at the time of impact. However, since the rudder is located at the rear of the aircraft, this impact would have occurred late in the accident sequence and does not necessarily indicate the rudder position just before the aircraft struck the water.

    No conclusive deformation or fracture patterns were observed in any of the rudder pieces that would indicate whether they had separated to the right or left, or whether they had twisted.

    Empennage Overall Determination

    The deformation and fragmentation damage to the two horizontal stabilizers was almost symmetrical, although the left stabilizer was slightly less damaged. This suggests that the impact was relatively symmetrical, but favoured the right side.

    Although there was physical evidence showing impact forces toward the rear, there were no conclusive deformation or fracture patterns that would indicate whether the horizontal stabilizer had separated upward or downward, with a nose-up or nose-down twist, nor was there evidence to indicate whether the vertical stabilizer had separated to the right or to the left. There was insufficient evidence to estimate the angles of bank, pitch, or yaw at the time of impact.

    Wings

    Pieces of wing structure from HB-IWF were individually identified and then laid out on the ground in their relative original positions. The aim was to document the recovered wing structure and, if possible, identify fracture and deformation patterns that could be used to determine the aircraft attitude at the time of impact.

    This process was limited to those pieces greater than approximately four feet in length, as the larger pieces would provide the clearest patterns showing the deformation of the wing as a whole. During the break-up sequence, certain areas may have been subjected to localized buckling; therefore, smaller pieces might show deformations contrary to those of the overall wing.

    Wing Skin Examination

    Left versus Right

    The left and right wings showed similar fragmentation. At the inboard ends, the right lower wing appears to have a slightly greater number of large skin pieces than does the left wing. At the outboard ends, the left wing appears to have slightly larger pieces.

    (See photographs of "Overhead view of right wing" and "Overhead view of left wing.")

    Top versus Bottom

    The upper skins were more severely fragmented than were the lower skins. The upper wing skins were manufactured from 7150-T6151 aluminum, which has a lower fracture toughness than the 2024-T351 aluminum from which the lower skins were manufactured. The upper skins were made of a thinner material than were the lower skins.

    (See illustrations of "Left wing - lower skins," "Right wing - lower skins," "Left wing - upper skins" and "Right wing - upper skins.")

    Wing Skin Bending Deformation

    Top versus Bottom

    The majority of the lower skins were bent concave down, whereas the majority of the upper skins were bent concave up.

    (See photograph of "Upper and lower bent wing skins.")

    Left versus Right

    The intensity of the bending deformation appears to be slightly greater on the left wing. There were several severely bent pieces from the left wing; the right wing pieces did not show the same extent of bending.

    Skin Torsional Deformation

    Each skin piece was examined to determine whether its outboard end tended to be twisted nose-up or nose-down with respect to the inboard end.

    Top versus Bottom

    The torsional deformation was much easier to observe on the lower skins, which tended to be larger and were made of a more ductile material.

    Left versus Right

    The left lower skin showed unique nose-up torsion; the right lower skin showed the torsion to be evenly distributed between nose-up and nose-down.

    Wing Skin Determination

    Since the salvage operation was thorough, especially with respect to large pieces, it is probable that most of the gaps in the reconstruction represent parts that had broken apart into pieces smaller than those being considered.

    The upper wing skins were more fragmented than the lower skins since the upper skins were of a thinner gauge and were manufactured using a material with a lower fracture toughness. While the right wing tended to be fragmented in slightly larger pieces, the difference in fragmentation between the left and right wings was not significant. This could suggest that the left wing was subjected to slightly greater impact energy; however, the differences are so small and so few that this may not be significant.

    Spanwise bending of the overall wing during impact would have caused the upper and lower skins to bend in generally the same direction, with a few possible discrepancies owing to localized buckling. However, the lower skins are bent concave down while the upper skins are bent concave up, which is not consistent with the bending of the overall wing at the time of impact. This particular mode of failure is likely the result of a hydrodynamic effect (of wing fuel or of seawater) that caused the wing to burst. Although the impact attitude would nevertheless have resulted in some bending of the wing skins, the hydrodynamic effect was so much greater that it masked the effect of the attitude. The severity of wing skin bending was slightly greater on the left than on the right. Although this could suggest that the phenomenon responsible for bursting the wings was more severe on the left, the difference is so subtle that it may not be significant.

    It was not determined whether the wing skin torsion deformation was caused mostly by impact attitude or by the hydrodynamic effect that burst the wing. Since the bursting effect was of such great magnitude that it overwhelmed the attitude effect in the bending mode, it probably also did so in the torsion mode. Therefore, the direction of the wing torsion is not considered to be a reliable indicator of the aircraft angle of attack at the time of impact. In the left lower wing the skin panels tend to be twisted in the same direction, whereas in the right lower wing they twist in both directions. This suggests that while the torsion in the left wing was the result of a single phenomenon, the torsion in the right wing had more than one cause.

    Stringer and Shear Clip Damage

    Damage to the stringers and shear clips of both wings was compared. Damage tended to be slightly greater on the left. However, since the differences between the sides are subtle, are open to considerable interpretation, and involve a small number of pieces, they may not be significant.

    The most common type of stringer damage in both wings was the fracture and separation of the vertical flange from the base of the stringer. Another type of stringer damage observed was where the stringers had been torn away completely from the wing skin. This type of damage was slightly more prevalent in the left wing than in the right wing. The final type of stringer damage observed was where the vertical flange was still partially attached to the base of the stringer. This type of damage was slightly more prevalent in the right wing than in the left wing.

    The most common form of failure in the left wing was the tearing away of the shear clips. In the right wing, many shear clips were still relatively intact.

    Wing Spars Examination and Determination

    Forward versus Rear Spars

    None of the large wing pieces examined were from the forward spar; the only large pieces were from the rear spar.

    Left versus Right

    The wing layout process included only the larger pieces of rear spar structure. Four pieces of the left spar and seven pieces of the right spar were recovered.

    Deformation

    Most of the spar pieces showed either deformation with the concave side toward the front or sinusoidal buckling deformation.

    Determination

    Since the front spar is thinner and taller than the rear spar, has holes in it for the slat tracks, and is located nearer the front (where it would absorb more impact energy), it is not surprising that the only surviving large spar pieces were from the rear spar. During impact, the wings would have been forced aft. This would have put a compression load in the rear spar, which could explain the sinusoidal curvature of many pieces. The appearance of the upper and lower wing skins suggests that the wing burst from internal pressures. This phenomenon may also explain why more spar pieces were found to have their concave face toward the front than toward the rear. The smaller number of large spar pieces recovered from the left wing suggests that the left wing was subjected to a greater impact energy, but since only a few large pieces were recovered, this may not be significant.

    Wing Ribs and Bulkheads Examination and Determination

    Left versus Right

    The wing layout process involved only larger pieces of rib and bulkhead structure. One piece from the left wing and four pieces from the right wing were recovered.

    Deformation

    Most of the pieces showed deformation with the concave side toward the right or sinusoidal buckling.

    Determination

    The smaller number of large rib pieces recovered from the left wing suggests that the left wing was subjected to greater impact energy, but since only a few large pieces were recovered, this may not be significant. There appeared to be a tendency for the rib deformation to favour the concave side to the right. In any case, it was not determined whether the curvature was caused by the fuel or seawater forces.

    Slat Tracks Examination and Determination

    Most of the tracks on the right wing were bent toward the right, whereas those on the left wing were about evenly divided between those bent left and those bent right.

    The slat tracks are normal to the wing leading edges, and the wing leading edges are swept back 35 degrees. Owing to this geometry, unless the aircraft had struck the water with a significant yaw angle, all the slat tracks on both wings would be expected to have been bent outboard. Almost all the tracks on the right wing were bent outboard, as expected. However, on the left wing, the tracks at the inboard end were bent outboard as expected, but those at the outboard end were bent inboard. One possible explanation for this is that, since there are two distinct modes of failure on the left wing, the left wing may have struck the water later in the accident sequence.

    Pylon Attachment Fittings Examination and Determination

    There is one such fitting associated with each engine. Both fittings were bent aft. The left fitting was bent further aft, but the spar at the right fitting is slightly more damaged. Seen from above, both fittings show clockwise torsional deformation.

    The fact that these fittings were bent aft is consistent with the engines having been forced nose-down during the impact. The left fitting is bent aft to a much greater extent than is the right fitting, which suggests that it received a greater impact force. However, the piece of the front spar at the top end of the right fitting was more damaged than was the left one. This suggests that the right fitting experienced less bending, not because it experienced a smaller force, but simply because it lost stiffness at its upper end owing to spar fracture. The engines are normally toed inboard 2 degrees. If the aircraft had struck the water with zero yaw, the engines might be expected to be forced nose-inboard, twisting both pylon attachment fittings inboard. Both fittings showed clockwise deformation (viewed from above), which means that the nose of each engine was pushed to the right upon impact. This suggests a nose-right yaw of greater than 2 degrees at the time of impact.

    The absence of any significant difference in the damage between the two wings suggests that there were no significant differences in the magnitudes and orientations of the impact forces that acted upon them. This, in turn, suggests a nearly symmetrical impact.

    Control Surfaces

    The control surfaces were examined for deformation and damage patterns with the following results:

    • No significant differences were observed between the left and right wings in the size or quantity of the pieces.
    • The left outboard flap had a vane track at its leading edge that was bent inboard.
    • The right wing fuel dump pipe was bent outboard.
    • The right inboard flap had a vane track at its leading edge that was bent inboard.

    Wingtips

    Winglets

    There were no significant differences between the left and right winglets in the damage they sustained. The outboard-most region of the right wing was still relatively intact, with the upper and lower skins still attached to the internal structure.

    Wing Overall Determination

    The deformation and fragmentation patterns did not vary significantly between the two wings. There were no significant differences in the magnitudes and orientations of the impact forces that acted upon them, which suggests a nearly symmetrical impact.

    Close examination of skin bending and torsion, slat track bending, and damage to the stringers, shear clips, spars, ribs, and pylon attachment fittings revealed subtle differences that suggest the left wing may have sustained greater damage, and that the aircraft may have been yawed nose-right at the time of impact. However, the differences were so subtle, and involved so few pieces, they were inconclusive. There was no conclusive evidence from which to estimate the angles of bank or pitch at the time of impact with the water.

    Cabin Outflow Valve Doors

    Cabin Outflow Valve Doors Examination

    The doors from the lower forward fuselage cabin outflow valve were recovered. They were submitted for engineering examination to determine whether they were open or closed at the time of impact.

    The entire door frame was recovered. The forward door is hinged along its forward edge, and opens by swinging outboard, away from the fuselage. The aft door is hinged along its aft edge, and opens by swinging inboard, into the left tunnel area. The doors are connected by a mechanical linkage, so they move in unison.

    Generally, the door frame structure was bent away from the door, so it did not capture the door in its position at impact. Only at one location, along the forward edge of the forward door, was the door frame deformed toward the door. The forward door was trapped in an open position by the deformed frame (i.e., it was swung outboard).

    (See photograph of "Forward door - edge-on view.")

    There is a very smooth mark visible along the length of the frame, probably the result of long-term wear. Although the door frame is deformed aft, the leading edge of the door itself has not been pushed aft by this frame. Rather, the leading edge of the door is bent inboard.

    (See photograph of "Forward door deformed inboard.")

    The aft door was not trapped by frame deformation, and was still free to swing open and closed. Damage near the lower hinge was probably caused when the hinge lug was bent. When the door is open (i.e., swung inboard), damage to the door's portion of the hinge lug aligns with damage to the frame's portion of the hinge lug. However, when the door is closed, the two damaged areas no longer align.

    (See photographs of "Aft door lower hinge in open position" and "Rear door - edge-on view.")

    None of the many scratches and gouges on the surfaces of the doors are continuous across the both doors. There were no marks visible on the frame or on the door that were consistent with an impact of the door against the frame.

    (See photograph of "Doors as recovered - exterior surfaces.")

    Uniform light soot was observed along the hinge line of the forward door. This soot was predominantly concentrated on the upper half of the door in the white painted area. A corresponding deposit of light soot was observed on the exterior skin of the upper half of the aft door. Localized deposits of moderate soot were also observed in depressions in damaged areas of the door. It is believed that the moderate soot deposits are representative of the exterior condition of the door prior to impact. The depressed areas would have preserved more soot deposits than other exposed areas. The inside surfaces of both doors also exhibited light soot deposits.

    Cabin Outflow Valve Doors Determination

    Not enough of the door actuator mechanism was identified to indicate the position of the doors at the time of impact.

    The forward door was trapped in the open position by the deformation of the adjacent door frame. This suggests that the door was open when the frame became deformed. The forward door frame was deformed aft. Had the forward door been closed when this frame deformation occurred, the front edge of the forward door would have been crushed aft. Instead, this edge was pushed inboard. The front edge of this door could only have been pushed inboard if the door had been open when the adjacent frame was deformed. After the frame had been deformed, the door was then forced closed against the deformed frame, causing the edge of the door to bend inboard. This suggests that the door was open when the frame was deformed.

    The observed soot pattern on both doors is consistent with the doors being open at the time the soot was accumulated. Little if any soot would be expected to have been deposited on the exterior skin of the forward door, since the exterior skin faces directly into the airstream. In contrast, the exterior surface of the aft door would have been exposed to smoke being expelled from the opening of the outflow valve.

    The only evidence found to suggest the position of the aft door at the time of impact was a mark on the lower hinge made when the hinge lugs were bent. This damage only lines up when the door is open, which suggests that the door was open when the damage occurred.

    Both doors appear to have been open in their appropriate directions when witness marks were created by the deformation of the frame and hinges. This suggests that the linkage between the two doors was still intact when those witness marks were created. Since the two doors were found apart, without the linkage mechanism, it is likely that the witness marks were created early in the accident sequence. The earlier the witness marks were created, the more likely it is that they are representative of the door position at the time of impact.

    Among all the scratches, gouges, and dents on the surfaces and edges of the doors, not a single mark is continuous across both. Had the doors been closed when the marks were made, some marks would be continuous across the doors. This suggests that the doors were not closed when the marks were made.

    Based on the damage patterns observed on the doors, it was determined that the doors were open at the time of impact.

    Cockpit Sliding Clearview Windows

    Description

    Each pilot is provided with a sliding clearview window. These are plug type windows that rest against a flange all around the perimeter of the sill. This flange reacts to pressurization loads and keeps the windows from being displaced outward. Along the forward edge of each window there are three blocks, which trap the forward edge of the window against the sill flange and stop the window from being displaced inward. Along the aft edge of each window, there are three moveable latches connected to a locking lever on the lower edge of the window. When these latches are extended, they trap the aft edge of the window against the sill flange. When these latches are retracted, the aft edge of the window is free to move inward.

    A crank and chain mechanism on the bulkhead below the window sill moves the window. To open the window, the locking mechanism is first released. This action releases the latches on the aft edge of the window, but does not move the window. By turning the hand crank the aft edge of the window is pulled inboard enough to clear the sill, whereupon it slides aft. When the aircraft is pressurized, the outward force on the window is so great that turning the hand crank will not open the window, although it can still be unlocked. The unlocked window would not affect the airflow in the cockpit as long as it remained unopened.

    First Officer's Window Examination

    The area of metal normally in contact with the latch was plastically deformed. The third latch plate, labelled "C," was missing, and the rivets that held it had sheared away. The damage at all three latch locations was consistent with the window having been forced inboard. Both the window and sill fractured at the same location and have the same bend at location "E."

    (See photograph of "First officer's window latch plate.")

    Indentations in the sill, at locations "E," correspond to the position and pitch of the fasteners used around the perimeter of the window. These indentations penetrate both the paint and the primer, and extend into the metal.

    (See photograph of "First officer's windowsill damage.")

    First Officer's Window Determination

    Damage to the two upper latch plates is aligned with the position of the latches when they are locked. Furthermore, the damage has the same shape as the ends of the latches. Therefore, the damage to the latch plates was likely caused by the latches. This is consistent with the latches having been locked at the time of impact.

    The separation of the third latch plate was consistent with the direction of the damage to the first two. The direction of this damage to all three latch plates is consistent with the window having been forced inboard by the impact.

    As the window and sill were fractured and bent at the same locations, they were likely in close contact when fractured. The window and sill are only in close contact when the window is closed, because the first action of the window-opening sequence is to move the window inboard so that it can slide back over the aft sill. The damage is consistent with the window having been closed at the time of impact.

    The marks along the sill were consistent with the pitch interval and location of the fasteners around the perimeter of the window. The depth of these marks, which in most instances penetrated both the paint and the primer, and indented the metal, was inconsistent with marks caused by long-term wear, which do not penetrate the paint. These marks are also consistent with the window and sill having been in close contact (and the window closed) at the time of impact.

    The physical evidence is consistent with the first officer's sliding clearview window having been closed and locked at the time of impact, and having been pushed inward by impact forces.

    Captain's Window Examination

    The metal on the two upper latch plates on the aft sill, labelled "A" and "B" has not been deformed as it was on the first officer's window. The lower latch plate on the aft sill "C" and its corresponding latch were still attached to the window structure.

    (See photographs of "Captain's window - upper latch plate" and "Captain's window - lower latch plate.")

    Latch Plate

    The captain's window latch plate and latch were not plastically deformed.

    Linking Arm

    The linking arm, which attaches the latch to the other latches, had fractured. When the latch is in the locked position, this fracture does not align with the fracture in the window and sill. When the latch is in the unlocked position, this fracture aligns with the fracture in the window and sill, at location "D" (see picture of captain's window - lower latch plate above). The arm is trapped and deformed in the retracted position and corresponds to the latch being in the locked position.

    Window and Sill

    At the lower aft corner of the window, both the window and sill fractured at the same locations. At the upper forward corner of the window, the fractures to the window and sill roughly align, but not as closely as at other locations.

    Marks on the sill correspond to the position and pitch of the fasteners used around the perimeter of the window. A survey of similar aircraft found that normal wear resulted in fastener marks on the sills, but that these marks never penetrated the surface of the paint. The remainder of the marks, however, penetrate both the paint and the primer, and extend as an indentation into the metal.

    Captain's Window Determination

    The three latch plates on the captain's window did not show the same damage caused by the latches as did those on the first officer's window. Although this may be an indication that the window was not locked, it is also possible that the two windows experienced different loads upon impact.

    In the vicinity of the lower latch, the sill and window fractured at the same location. If the fracture of the linking arm, which is in the same area, is aligned with the other two fractures, its position corresponds to the window being unlocked. Although this may be an indication that the window was not locked, it is also possible that it is the result of the particular loading experienced during impact.

    The telescoping arm, which moves the latch, was jammed in the locked position. Although this may be an indication that the window was locked, it is also possible that, since it is cable actuated, the cable pulled it to the locked position during the break-up sequence. The physical evidence described above is inconclusive regarding whether the captain's window was locked at the time of impact.

    At the lower aft corner, the window and sill were fractured at similar locations, which is consistent with the window having been closed. However, there were discrepancies at the upper aft and upper forward corners, where the fractures lined up less precisely. These discrepancies may indicate that the window was slightly open. They may also be the result of the influence of the pivoting joint in the upper aft corner of the window, which could have affected bending forces in the window.

    The marks along the sill were consistent with the pitch and location of the fasteners around the perimeter of the window. In most instances these marks penetrated both the paint and the primer, and indented the metal. This is consistent with the marks having been caused by the impact and with the window having been closed at that time.

    The physical evidence concerning the position of the captain's sliding clearview window was less conclusive than in the case of the first officer's window. While there was no evidence to indicate that it was locked, it is believed to have been closed.

    Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
    Transportation Safety Board of Canada
    Symbol of the Government of Canada

     AVIATION REPORTS - 1998 - A98H0003

    Techniques, Tests, and Research

    1. Recovery Procedures
    2. Management and Interpretation of Information
      1. Evidence and Reports III Database
      2. TSB Control Log Database
      3. SUPERText® Software
      4. Photo Database
      5. CSRTG Database
      6. Geographic Information System
      7. PRODOCs Application
    3. Speech Micro-coding Analysis
    4. Aircraft Engine Analysis
    5. Auger Electron Spectroscopy
      1. Generation of Exemplar Arc Beads for AES
    6. Simulator Trials
    7. Temperature Reference Coupons
    8. Soot and Colour Reference Standards
    9. Map Lights
    10. Airflow Flight Tests
    11. Computer Fire Modelling
      1. Pre-fire Airflow Modelling
      2. Fire Modelling
    12. In-Flight Fire Time Study

    Recovery Procedures

    To control and document the disposition of recovered aircraft debris, an aircraft exhibit control team was established in collaboration with the RCMP. The exhibit control team was assigned the following tasks:

    • Maintain continuity (chain of evidence) of all recovered aircraft debris.
    • Sort, organize, and store all recovered aircraft debris.
    • Identify specific items of higher importance to the investigation.
    • Maintain the exhibit records.
    • Create a database of detailed information on all stored exhibits.

    Recovered aircraft debris was transported to shore by military, CCG, and civilian sea vessels. All recovered materials were taken to 12 Wing Shearwater. Some materials were also transported by helicopter. High-priority items, such as key aircraft components, currency, and valuables were recovered, secured, and hand-delivered to Shearwater by TSB or RCMP personnel. Paper items retrieved from the ocean, such as aircraft manuals, were freeze-dried to prevent further deterioration.

    Upon arrival at Shearwater, the debris was washed in fresh water and processed through a decontamination line, located alongside the unloading dock. Personal effects and aircraft wreckage were separated, placed into large cardboard containers, and transported to "A" Hangar at 12 Wing Shearwater. Human remains were transported to the temporary morgue, located in "B" Hangar at 12 Wing Shearwater.

    Aircraft debris arriving at "A" Hangar was sorted and examined by a team of TSB, Boeing, Swissair, and RCMP personnel. Each item was examined to determine its approximate location within the aircraft (nose, wing, centre, tail) and to assess the significance of the item to the investigation. Particular emphasis was placed on debris exhibiting heat damage, burn residue, or unusual markings. Each item of debris was designated as either initially non-significant or significant to the investigation. Assistance was provided by personnel from the NTSB, the Swiss AAIB, the ALPA, Pratt & Whitney, and various other companies and organizations.

    It is estimated that more than 2 million pieces of wreckage were recovered. To organize the storage of this debris, a grid system was laid out in "A" Hangar to represent various sections of the aircraft, as follows:

    Table: Grid System

    Agency Role(s)
    TSB Lead agency
    Accident and safety investigations
    (in accordance with ICAO SARP Annex 13)
    Custodian of aircraft accident evidence
    Coordination of activities
    RCMP Co-lead agency
    Criminal investigation
    Recovery
    Victim identification
    Custodian of personal evidence
    Victims services assistance (support to families)
    Support to the OCME
    Support to the TSB
    CF SAR
    Search and recovery
    Command and coordination
    Facilities and logistical support
    Site security
    DFO
    CCG
    BIO
    MSEP
    SAR
    Search and recovery
    Coordination
    Reconnaissance
    Marine transport services
    Site security
    Underwater surface imaging
    Nova Scotia OCME Identification and control of human remains
    Liaison with victims' families
    USN Search and recovery (USS Grapple)
    EPC Federal agency coordination
    Nova Scotia OCME
    Grid Aircraft Section
    1 Left Wing Upper
    2 Left Wing Lower
    3 Tail
    4 Aft
    5 Miscellaneous
    5B Fire
    6 Centre
    7 Forward
    8 Nose
    9 Right Wing Lower
    10 Right Wing Upper
    11 Engines
    12 Seats
    12A Wiring

    Non-significant items identified as belonging to a specific section of the aircraft were placed, when possible, into large storage boxes fabricated from tri-wall cardboard. Several storage boxes, each corresponding to a grid section, were set up inside "A" Hangar. Non-significant items were placed inside the storage box that corresponded to the item's original location (grid section) on the aircraft. For example, a piece of aircraft tail section would have been placed into a storage box labelled Grid 3—Tail. Once a long-term storage box was full, it was weighed and transported from "A" Hangar to "J" Hangar at 12 Wing Shearwater, a temporary hangar constructed specifically for long-term storage of aircraft parts. Each storage box was given an exhibit number and was labelled with a description of the contents, weight, and "J" Hangar location.

    If a recovered item was too large to be placed inside a long-term storage box, it was weighed and placed outside in a secure compound next to "J" Hangar. The compound was a fenced-in storage area into which large pieces of recovered aircraft were placed and grouped in accordance with the grid system. For example, a large piece of recovered centre fuselage would be placed inside the compound in the area labelled Grid 6—Centre.

    Significant items and parts used in the reconstruction mock-up were photographed and entered into the exhibit control system by an RCMP exhibit custodian. The exhibit custodian assigned a unique exhibit number to each item, completed an exhibit report for each item, and recorded the details of each exhibit in the master exhibit ledger. A textual summary description was also produced for each exhibit. Unique exhibit numbers and summary descriptions were also assigned to groups of related items and to each long-term storage box containing non-significant items.

    The exhibit numbering system comprised an exhibit number followed by an individual item number. The exhibit number "1" designated the item as an aircraft exhibit. The exhibit number was followed by an item number assigned to that particular exhibit (item numbers started at 1 and increased sequentially). As an example, Exhibit 1-2385 indicates that the item is an aircraft exhibit with the unique item number of 2385. These numbers, which were used as the primary reference in all electronic databases and written reports, provided investigators with a means of tracking, locating, and retrieving specific wreckage items. Exhibit numbers were also used to link and relate different types of information to a specific piece, or pieces, of wreckage. For example, photographs, laboratory test results, notes, and textual descriptions could be electronically associated with one or more exhibits. This information could then be electronically filed, organized, queried, and retrieved.

    The exhibit custodian completed an exhibit report data capture sheet for each new exhibit, including the following information:

    • Exhibit number
    • Item number
    • Date and time
    • Anatomy, aircraft, or property
    • Description and measurements
    • Serial number/part number
    • Date item was found
    • Location where item was found and by whom
    • Storage location
    • Name of exhibit custodian completing the report

    Sections of the exhibit report that could not be completed were left blank. If a detailed description of the item was not available, a general description of the item was recorded (e.g., "piece of green metal, unidentified"). If an exhibit was moved from its original storage location to a new location, an Exhibit Movement form was completed to maintain an accurate record of the location and movement of each exhibit.

    An exhibit tag was completed for each new exhibit and placed next to the exhibit on the examination table. The tag was labelled with the exhibit number and the item number (e.g., 1-4325). A member of the RCMP forensic identification team then photographed the exhibit for identification purposes, including the exhibit tag. The exhibit was photographed with both a 35 mm camera and a digital camera. Additional photographs were taken by TSB investigators as required.

    Once the exhibit was photographed, the exhibit tag was attached to the item with either a permanent metal or plastic fastener. If it was not possible to attach the exhibit tag, the exhibit and the tag were placed inside a clear bag and sealed. The exhibit and item number were also written directly onto the exhibit with a red permanent marker.

    The exhibit was then taken by a member of the exhibit team to the appropriate storage location inside "A" Hangar where it was kept until further analysis could be completed. Sensitive or high-priority exhibits were stored within a secure exhibit room, which was initially maintained by the RCMP inside "A" Hangar.

    Long-term storage boxes used to sort non-significant aircraft debris were also identified as exhibits. Entering the storage boxes as exhibits allowed the exhibit control team to maintain continuity of all recovered aircraft items. For each box, an exhibit and item number was assigned, an exhibit report data sheet was completed, and an exhibit tag was attached. The following information was recorded on each side of each storage box:

    • Exhibit and item number (in red)
    • Grid number and description of the box contents (in black)
    • Storage location within "J" Hangar (in green)
    • Weight of the contents (in blue)

    Exhibit photographs and exhibit report data sheets were entered into the RCMP Evidence and Reports III database. The Evidence and Reports III database enabled investigators to retrieve exhibit data and to generate summary reports. The following information was recorded in the master exhibit ledger as a backup to the electronic database:

    • Exhibit and item number
    • Exhibit description
    • Exhibit storage location

    As recovered aircraft debris was processed at 12 Wing Shearwater, the weight of the debris was recorded in a master file. Exhibit control personnel continually updated the recovered weight of the aircraft debris (in total weight and as a percentage of the aircraft structural weight) and provided this data to investigators. (STI) The weight of the recovered aircraft debris allowed investigators to monitor the progress of the recovery operation. Approximately 98% (by structural weight) of the aircraft was ultimately recovered. (STI)

    Management and Interpretation of Information

    Several primary databases were established early in the investigation to assist in the management and tracking of investigation material.

    Evidence and Reports III Database

    The RCMP Evidence and Reports III database served as a repository of textual and photographic information about wreckage exhibits, including significant pieces of aircraft debris and bulk containers filled with non-significant debris. The Evidence and Reports III database user interface enabled the production of summary reports on specific exhibits.

    TSB Control Log Database

    Additional investigation data in various formats, including audio cassettes, compact and floppy disks, microfilm, engineering drawings, text documents, facsimiles, and manuals were recorded in the TSB Control Log database. Similar to the wreckage exhibit system, a unique master number was assigned to each data item, or group of related items, in the control log. A general investigation subject file number was also assigned, and a short summary description was prepared including information about the media type, the origin of the data, when the data were received, and by whom. The Control Log database allowed investigators to track and retrieve investigation data and to electronically search fields for key words and phrases contained in any field. This capability was subsequently augmented by importing much of the textual data into the SUPERText® case management system.

    SUPERText® Software

    SUPERText® software[1] was used to scan records and their associated summary descriptions. Embedded OCR algorithms were applied to extract the textual content of each document image in order to support electronic searches within the body of each scanned document. Additional software functions were used to further categorize the scanned documents into specific subject areas and to create search indexes within the SUPERText® image database. SUPERText® search functions enabled users to retrieve documents using a variety of search criteria including "keyword" and "text string" searches, and to view or print high-quality images of these documents. SUPERText® search results could be used by investigators in different geographic locations over a computer network or via remote access connections to the network.

    Photo Database

    A photo database was developed to archive the large volume of digital images that were not associated with a particular exhibit and that were not, therefore, contained within the Evidence and Reports III database. The database was indexed to allow flexible searches by subject matter, date, location, and various other parameters.

    CSRTG Database

    For many years, the aviation authorities of North America (US FAA and TC Civil Aviation), Europe (JAA), and Japan (JCAB) have been conducting individual and cooperative research in transport category aeroplane cabin safety. The CSRTG database is a repository for the cabin safety research efforts of the FAA, the JAA, the JCAB, and TC. The CSRTG database currently contains information on over 2 400 accidents. While the database was initially intended to support analytical work aimed at improving occupant survivability, the scope has recently been expanded to include information on non-survivable accidents. All data have been derived from reliable sources, primarily from accident investigating authorities. Records are stored for transport category passenger aircraft (those with 19 or more passenger seats) and cargo aircraft certified under the FAA, Part 25 requirements or their equivalent. The database contains photographs and diagrams as well as textual and numerical data. The CSRTG database was used by investigators to identify and validate the circumstances of previously reported aircraft accidents involving fires on transport category aircraft.

    Geographic Information System

    The TSB developed a GIS to manage, correlate, and interpret spatially referenced exhibits and investigation data.[2] These data were stored on various media and recorded in one or more of the investigation databases. The GIS enabled the processing and analysis of large amounts of diverse information related to a particular location on the aircraft or on the surface of the earth. Examples of such data include bathymetry, topography, satellite imagery, radar images, laser environmental airborne fluoro sensor plots, aircraft flight path data, witness data, and wreckage exhibit data. A three-dimensional digital terrain model of the ocean floor was created and used in the GIS. The GIS approach was also used to facilitate the three-dimensional CAD reconstruction of aircraft occupant and aircraft wreckage information and for the analysis of fire damage. The spatial reference used was related to the aircraft coordinate system for a Swissair-configured MD-11 aircraft model.

    Investigation photographs were taken with 35 mm, colour-reflex cameras and supplemented by digital camera photography. Digital photographs were often taken at the same time as 35 mm colour photographs, particularly when wreckage was being processed through the exhibit system. Digital photography was used to provide immediate image results to investigators and to serve as a backup to the colour negative film in the event that the photographs did not develop as expected. The 35 mm film was subsequently developed and the negatives were scanned onto a five-pack format Kodak® photo CD-ROM. The original negatives were then placed into a secure storage facility. Exhibit numbers present in the photographs and digital imagery were used to identify and subsequently catalogue pictures on CDs using the exhibit system. CDs were loaded into a multiple CD player unit, which was connected to the GIS through a computer network. Digital images were then retrieved, electronically processed (to adjust variables such as brightness, contrast, sharpness, and enlargement factors), and printed or copied for distribution. Segments of video and audio tapes were also digitized and incorporated into the GIS.

    In order to create 360-degree views of the aircraft interior, a series of static photographs were taken with a tripod-mounted 35 mm camera fitted with a 20 mm lens and rotated in 20-degree increments. The resulting images were stitched into a continuous, 360-degree panorama using PhotoVista® 1.0 software, part of the Reality Studio software suite by Live Picture, Inc.[3] When the panorama is displayed on a computer, the viewer is able to navigate horizontally or vertically around the image. In addition to offering a wide field of view, the image can be magnified by electronically zooming in on a feature. The enhanced view can be printed, saved, and forwarded as an electronic file. The original panorama can also be saved or forwarded.

    The Reality Studio software was also used to define links (hotspots) between individual panoramas by creating points within the imagery that allowed the viewer to jump from one panorama to another. Linked panoramas enabled investigators to navigate between various scenes. For example, a series of panoramas were made of the interior of different Swissair MD-11 aircraft in various states of repair and maintenance. The panoramas enabled areas, such as the cockpit to be compared to a normal interior. The normal interior was subsequently removed in stages to show underlying features that are not normally visible, including paint schemes, fabric types and patterns, the location and orientation of decals and labels, and various construction details. This information was used to assist in identifying and reconstructing the wreckage.

    To photograph inaccessible areas, a remote-control, auto-focus camera with an integrated flash unit was placed on a pole, which could be rotated. The camera assembly was then projected up (like a periscope) into tight spaces, such as ceiling attic areas, to take panorama images. Digital cameras were frequently used in difficult circumstances to obtain immediate results. The same viewpoint was often re-photographed with a film camera. The 35 mm negatives were subsequently scanned into an electronic format to create high-resolution images where fine detail was needed, and to enable investigators to view regions of the aircraft that were difficult to access or physically examine.

    Additional panoramas were taken in the aircraft wreckage three-dimensional reconstruction mock-up. The locations of these panoramas corresponded to the positions of panoramas taken of in-service aircraft. Electronic viewers were programmed to display two panoramas simultaneously, which enabled direct comparisons to be made between an intact aircraft and the badly damaged aircraft reconstruction. Panoramas were also taken at witness locations, which were used to better interpret witness statements.

    Two-dimensional models of specific objects were created using Object Modeler® 1.0 software, also part of the Reality Studio software suite. In contrast to a panorama where a camera is rotated about a single point to document a scene, an object model was made by fixing the camera in position and rotating the object about a single point. Pictures were taken of the object in 10-degree increments as it was rotated through 360 degrees. This process was often repeated at different elevations (high and low vantage points) with respect to the object. In a process similar to the creation of a panorama, stitching software was then used to create a 360-degree view of the original object, which the viewer could rotate, zoom, and save or transmit as an electronic file. Panoramas and object models were also integrated into the GIS.

    Three-dimensional CAD drawings of the aircraft were received from the aircraft manufacturer in Unisis format. CAD models[4] of the aircraft structure were developed to depict the orientation and estimated temperature of specific components. Using the GIS coordinate system, these models were cross-referenced to panoramas, object models, photographs, and textual information about recovered components. This supplementary information could be retrieved by positioning a cursor over the CAD representation of the component of interest. Investigators used these tools to analyze the routing and orientation of various components, to review temperature patterns, and to develop airflow and fire propagation scenarios.

    Standard Internet browser utilities were used to view CAD presentations, object models, and panoramic images. Panoramas and object models use a common image format[5] as a texture for a Virtual Reality Modelling Language 2.0 environment. The Flashpix® image format uses streaming technology and was specifically designed to provide high-resolution images over the Internet. The panorama or object file can be exported as an IVR file to a web browser plug-in that interprets the file, enabling the images to be viewed in an HTML environment. In this way, investigators were able to access, rotate, and zoom two-dimensional panoramas and object models of the aircraft interior and to navigate from one perspective to another using a standard web browser. The Whips 2-D viewer and Voloview 3-D viewer, both by Autodesk Incorporated, provided a similar capability to view CAD drawings with a web browser.

    PRODOCs Application

    The TSB developed the PRODOCs application to provide a single point of access to investigation data from the Evidence and Reports III database, the SUPERText® database, Document Control Log database, and the photo database. It also provides links to other related resources and applications, including the CSRTG accident database, technical notes, photographic panoramas and object models, two-dimensional and three-dimensional CAD diagrams, and video clips of various investigation activities.

    Speech Micro-coding Analysis

    Numerous studies[6] have demonstrated a strong relationship between language use and human performance. In aviation, positive correlations exist between the verbal communication characteristics of flight crew members and ATC and flight outcome measures. An in-depth analysis of the verbal communication obtained from the CVR and ATC tapes was conducted to assess, as objectively as possible, crew interactions including crew coordination, workload, and problem solving in handling the emergency. Using contemporary communication theory and research[7] and previous experience, a speech micro-coding protocol was refined to classify verbal communication segments in order to derive and analyze relevant data. The protocol was applied in the context of Swissair procedural information, FDR data, and the ATC MANOPS to analyze the verbal communication relevant to the objectives listed above.

    Cockpit crew communications were partitioned into VTUs. VTUs are utterances dealing with a single thought, intent, or action. A single sentence may contain more than one VTU. Each VTU was then coded according to the time of onset, the speaker, the target, the speech form employed, a qualitative descriptor, and an action decision sequence.

    The time of onset was measured in CVR time minutes. A time latency factor was included to indicate the time between the onset of one VTU and the onset of another. This factor was helpful in determining not only the rapidity of the expected response but also the connection between the VTUs. The speaker was the originator of the communication and the target was the intended receiver. Each VTU was classified according to a particular speech form and qualitative descriptors were used to evaluate the adequacy and appropriateness of the communication. Action decision sequences were used to link the VTU to an event requiring coordinated action among crew members, interaction external to the cockpit (e.g., ATC), or both.

    The following nine speech forms were used to classify the VTUs.

    • Command: A clear instruction to act in a specified manner.
    • Advocacy: A suggestion to act, given as a suggested approach.
    • Observation: A non-directed comment giving information related to a current or anticipated condition or state.
    • Acknowledgement: A statement of concurrence or an indication that information has been received, given in response to a command or observation.
    • Inquiry: A request for information or direction.
    • Reply: A meaningful response to an inquiry.
    • Identification: A greeting or identification/acknowledgement of the speaker.
    • Exclamation: An expression of surprise or emotion.
    • Alert: Information indicating a condition of heightened concern or preparation for action.

    Coding of speech forms can provide valuable insight into communication dynamics. Speech forms describe the variety of communications modalities available to the communicator.

    Using this technique, the VTUs are qualitatively coded to determine the effectiveness of the verbal communication[8] among the flight crew, between the flight crew and the flight attendants, and between the flight crew and ATC. Some of the VTUs can represent miscommunication; that is, the utterances might be incomplete, ineffective, incorrect, or inferentially changed and were coded as such. Often in communication, the response to a question may be delayed because the recipient of the question does not know the answer and must expend time gathering information to respond, other tasks may have priority, or the recipient may be fully occupied with another task that needs immediate attention. The risk of delayed communication is that other events take priority and the original request may be lost. The term "deferral" is included as a descriptor to capture and track communications of this type. To also capture the dynamics of the trans-cockpit authority gradient, communication is coded as "deferential" when the communication indicated deference to authority, and "take over" when the communication expected of one crew member is executed by the other crew member.

    The following qualitative descriptors were used to classify the VTUs:

    • Incomplete: A communication devoid of meaningful content owing to poor communication style or a break in verbal transmission.
    • Ineffective: Communication that is not appropriate for the situation and does not achieve the intended goal.
    • Incorrect: A reply that is clearly incorrect, such as an incorrect read-back or a response that does not answer the question posed.
    • Inferential change: Communication wherein the meaning or intent of a communication that has been received is changed.
    • Deferral: A reply to an inquiry indicating that the answer will be forthcoming.
    • Deferential: Communication intended to indicate deference to authority.
    • Take over: Communication to ATC Tower by one crew member where one would reasonably expect it to be made by the other.

    Coding the action decision sequences enabled an analysis of how task focus, as measured through verbal behaviour, was distributed across crew members. These sequences are communications linked to an event that required coordinated action among crew members, interaction external to the cockpit, or both. Coding the sequences in this manner enables crew interaction to be reduced into a relatively limited number of behavioural sequences that effectively capture the multiple tasks faced by a crew.

    The following descriptors were used to code the action decision sequences:

    • Flight control: Actions related to handling the aircraft.
    • Nav control: Decisions relating to the flight path of the aircraft.
    • Damage assessment: Assessment of the nature and extent of damage to the aircraft; identification of operational and non-operational systems.
    • Problem solving: Operational communications addressing problem solving; corrective actions, completion of abnormal checklists.
    • Landing: Identification of potential landing sites, location of alternatives, non-standard or abnormal landing preparation.
    • Emergency preparation: Emergency landing, cabin preparation, reporting persons on board and fuel, non-standard requests for support.
    • Social: Non-operational communications addressing social-emotional and team-building concerns, introductions, tension release, affective support.

    In order to allow tabulation of the number of codings per unit time, the CVR was segmented into equal segments of 2.5 minutes of CVR time.

    Much of the CVR is a record of voices and sounds recorded on the CAM channel. CAMs typically give a poor signal-to-noise ratio because of the distance to the microphone from the speaker and the level of steady-state ambient noise in the cockpit. In terms of communication data, voice recordings are limited in that they give little non-verbal communications information. The influence of the crew's dialects, combined with the low signal-to-noise ratio, in particular from the CAM, also resulted in ambiguous interpretations of a few phrases.

    The potential influence of ambiguous data on the speech micro-coding and analysis process was mitigated by implementing the following guidelines:

    1. Acknowledge ambiguities in the data and develop procedures to deal with them.
    2. Use the procedures consistently.
    3. Do not use data for analysis if it is ambiguous.
    4. Note that most of the available data comes from verbal behaviour only; just because nothing is heard does not necessarily mean that nothing was communicated.
    5. Assume that the ambiguities will be evenly distributed across the record, although there may be an oxygen mask effect (i.e., the mask has a hot microphone that may give a better recording quality).
    6. As this analysis is largely a classification exercise, recognize the limitations inherent in the chosen definitions and categories (note how Observation was divided into two categories: Alert and Observation).
    7. Note the trade-off between the number of categories used and accuracy—the fewer the categories, the more the groupings lack analytic definition; the more categories that are used, the more likely it is that there will be too few data points in each to enable meaningful analysis.
    8. Analyze cabin crew conversations only if cabin crew members were interacting with flight deck crew.
    9. Note the possible problem related to double counting repeated thought units.

    Aircraft Engine Analysis

    During the investigation of the aircraft engines, a need arose to determine the position of the spool valve within the body of the thrust reverser system HCU. The first option was to disassemble the unit. During disassembly, however, it is possible to alter the positioning of the spool valve and, in light of the corrosion that had developed from submersion in the ocean water, disassembly would have been difficult. Instead, the unit was transported to an industrial x-ray facility at 12 Wing Shearwater where it was subjected to an x-ray process. Analysis of the x-ray film easily identified the control valve position within the HCU body. The x-ray taken prior to disassembly documented the internal positioning of the components for reference purposes. This technique was also used to view the locking mechanism of the thrust reverser system locking actuators.

    The on-site, external examination of the FMUs determined that the resting position of the sector gears differed between the three units, suggesting different fuel flows to each of the three engines at the time of impact. Physical examination of the engines also indicated different power settings. As the position of the sector gears is directly related to the position of the fuel metering valve and fuel flow, the FMUs were transported to the manufacturer for disassembly and examination. During the examination, the position of the fuel metering valve spool relative to the metering valve sleeve was measured and compared against the manufacturer's drawings to determine the fuel flow from these measurements. This information, along with information gathered from other areas of the engines, helped to determine the approximate thrust setting for each engine at the time of impact.

    The VSV control subsystem provides maximum compressor performance by moving the HPC inlet guide vanes and fifth-, sixth-, and seventh-stage HPC vanes to their programmed positions in response to commands from the FADEC. During an engine start, the VSVs may be in an open position until approximately 15% N2, at which time they would close. At speeds above approximately 40% N2, the VSVs modulate to open with increasing N1 and N2 and are fully open at take-off and climb power. The vanes modulate with N1, N2, and Tt2 changes.

    The three VSVs were transported to the manufacturer's facility for disassembly and examination. Measurements were taken from the centre of the piston face to the actuator aft housing surface. This measurement was used to determine the position of the piston relative to the piston full stroke. The results of this calculation were then interpreted to provide the engine thrust level. This information, along with other factual information gathered from the FMUs and bleed valves, helped to establish the thrust levels of the SR 111 engines at the time of impact.

    The 2.5 bleed air subsystem increases compressor stability during starting, transient, and reverse thrust operation. The 2.5 bleed valve is connected to an actuator through a bell-crank, and when the valve is open, it releases fourth-stage LPC air into the engine fan airstream. It is controlled by the FADEC as a function of TRA, N1, N2, Tt2, M, and altitude. During an engine start, the valve is commanded fully open and will begin to close at approximately 84% N2. If a surge is detected on an engine, the valve is commanded fully open. This valve is also fully open during reverse thrust operations on the wing engines, but only half open on the tail engine.

    The three bleed valves were disassembled and examined at the manufacturer's facility. Measurements were taken from the mounting surface of the housing to the end of the piston to determine the "as-received" position of the piston. This measurement value indicates the position of the piston relative to the fully extended position, and thus reflects the percentage of its full stroke. This percentage reflects the engine thrust level in engine revolutions per minute at the corrected low pressure rotor speed. These values were not used in isolation, but along with other factual information gathered from the engine examination.

    The 2.9 bleed valves, located at the ninth-stage HPC, improve compressor stability during starting and transient operation. The FADEC controls the left 2.9 stability bleed valve as a function of corrected N2, altitude, and time, and controls the right 2.9 start bleed valve as a function of corrected N2. During an engine start, both valves are open. At approximately 2% N2 below idle speed, both valves close. If the FADEC detects a surge at any time, the left valve opens. The left valve also opens for up to 180 seconds if the engine is decelerated below approximately 81% N2 and the altitude is between approximately 16 000 and 20 000 feet. It closes upon acceleration. The valves are spring loaded open and commanded closed by the FADEC.

    Visual examination of the six 2.9 bleed valves determined whether the valves were open, closed, or jammed in a position as a result of impact. This information, along with other factual information, helped to determine thrust levels when the engines struck the water. (STI)

    The FADEC is the source of stored information that is particularly useful for investigating accidents in which the FDR has stopped, as it did near the end of the SR 111 flight. The information may be downloaded from the FADEC NVM at the manufacturer's facility. If the time reference captured on the NVM can be accurately related to actual time, then engine faults stored in the NVM can help to determine the engine status during the accident sequence. If only airframe faults but no engine faults are captured in the FADEC NVM, then, if the FADEC was powered, it can be assumed that there were no deficiencies associated with the engine. The airframe faults, especially faults written to the FADEC about components that provide input data to the FADEC, may help to establish the engine mode of control at the time of the occurrence. The stored airframe faults may help to establish the serviceability of the airframe during the accident flight. Analysis of the FADEC-stored faults determined the SR 111 mode of control of the engines and also provided some altitude and time reference information during the last minutes of flight.

    Auger Electron Spectroscopy

    AES is a forensic technique that was used to help differentiate between electrical wire arcs that could have caused a fire and arcs that resulted from a fire. The technique is based on the premise that combustion by-products are trapped in the re-solidified copper that is briefly melted when the electrical arc occurs. As the melted copper solidifies, it forms a bead at the site of the arc. Gases can be trapped near the surface of the metal because of its high solubility and rapid cooling. If the arc precedes the fire, the host atmosphere will be relatively clean and oxidizing. The near-surface composition of the arc bead will, therefore, exhibit relatively low levels of hydrocarbon contaminants and trapped combustion gases. Conversely, if an arc occurs when a fire is in progress, the near-surface chemistry of the arc bead will include a complex mixture of gases and particulates from the combustion of various materials and lower levels of oxygen. Depth profiling of the near-surface chemistry of arc beads is a critical factor in discriminating between arc beads that were formed in clean or contaminated environments. In all cases, when exposed to a fire environment, the arc beads will be coated with a surface layer of hydrocarbon contaminates (soot). However, arc beads formed in a contaminated environment will contain combustion by-products to a depth of at least 500 Å, which is a distinguishing characteristic.

    AES analysis is limited to metallic melt surfaces that are smooth, flat, and have no porous regions or crust. Because arc melts with an irregular surface geometry, porous regions or crust remnants are unlikely to have captured the chemical signature of the ambient environment when the arc was formed. An important first step in the AES process is the selection of suitable sites on the metallic melt surface for detailed analysis. Selected sites, typically small spots of less than 1 µm in diameter, are then probed to eliminate any foreign artifacts from the analysis volume. Knowledge of the vertical elemental profile, morphology, and porosity of selected arc sites is then obtained by combining AES techniques with FIB etching and TEM.

    The TSB contracted with the CANMET Materials Technology Laboratory to assess the differences in the wire arc beads at the chemical/microscopic level between a bead formed in a pre-fire (clean) environment, and a bead formed in a fire (contaminated) environment. The objective was to determine whether it was possible to isolate an individual arced wire as a lead event in the SR 111 fire.

    An initial proof-of-concept AES examination was conducted using 24 exemplar wires containing arc-produced beads that were created in controlled conditions. Under the direction and control of TSB investigators, these samples were created at Boeing Corporation, Seattle, from types and gauges of current-carrying wires that are typically found on the MD-11 aircraft. Of these wires, 14 were arced in a clean environment to replicate pre-fire conditions and 10 were arced in a fire environment. Before they were examined, five of the arced wires created in the clean environment were exposed to a fire environment. This was done to replicate such a potential fire scenario. Of the 14 wires that were created in the clean environment, 9 were correctly identified as such by AES testing. Of the five wires that were subsequently exposed to a fire environment, two were correctly identified as being originally arced in a pre-fire environment. Of the 10 wires created in a fire environment, 9 of these wires were labelled inconclusive and the tenth wire was incorrectly identified as having arced in a pre-fire environment. Wires that had been exposed to a fire environment were often coated with soot and combustion residue. This crust of contamination could not be completely removed without potentially influencing the test results. This resulted in many inconclusive AES test results for these wires. When evidence of post-arc heating was present on the wire specimen, the use of AES to distinguish between arcing causing a fire and arcing as a result of fire usually became inconclusive.

    During the proof-of-concept test activity, the AES methodology for examining arc beads continued to evolve. A decision was made to proceed with the examination of electrical wires from SR 111 that exhibited areas of molten copper. It was believed that certain refinements to the AES process could provide valid information and increase confidence in the results.

    The AES methodology was used to examine 21 wire and cable exhibits recovered from SR 111. Thirty-five suspected arc-melt zones were cut from the 21 wire exhibits and probed by AES, typically at two or more locations per specimen. Efforts to characterize individual specimens were hampered by several factors. For example, many of the SR 111 specimens were not simple spherical beads on a wire strand or wire bundle. The method of capturing and comparing information between beads required that an electron gun be aimed at the surface of each specimen at a consistent angle. The irregular morphology of the specimens made it difficult to find areas with sufficient similarity to obtain usable and comparable information. In addition, the SR 111 wire specimens had been submerged in salt water for many weeks and were coated with post-crash artifacts resulting from aqueous organic and inorganic bio-geochemical activity. The wire specimens were therefore subjected to rinsing and ultrasonic cleaning in demineralized distilled water in an attempt to remove the post-crash contaminants. However, it was not possible to fully remove all of the contaminants by this method and other cleaning methods were not used because of their potential to affect the validity of the AES test results.

    During the preliminary AES analysis, it was determined that the copper melt regions on 3 of the 23 wire exhibits were not consistent with electrical arcing, thereby reducing the number of valid wire arc exhibits to 20. The preliminary AES analysis also identified 16 of the 35 original specimens as suitable for further analysis. The morphology and micro-structure of the surface and near-surface region of these 16 samples was examined using FIB sectioning and secondary electron imaging to determine whether cracks or pores were present. TEM was employed to examine seven FIB-generated lift-out samples.

    A seawater testing program was undertaken to determine the effect of seawater exposure on AES-derived surface an Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003

    Transportation Safety Board of Canada
    Symbol of the Government of Canada

     AVIATION REPORTS - 1998 - A98H0003

    IFEN – Continued Airworthiness

    1. Maintenance Instructions for Continued Airworthiness
    2. Service Bulletins
      1. Interactive Flight Technologies Inc.
      2. Hollingsead International
      3. PA System
        1. Installation Information
    3. IFEN System Maintenance Records
      1. Power Supply Failure
    4. FAA Policy Statement ANM-01-04 – System Wiring Policy for Certification of Part 25 Airplanes
      1. Statement of FAA Policy
      2. IFE System STC Design/Installation

    Maintenance Instructions for Continued Airworthiness

    HI developed and issued the Maintenance Instructions for Continued Airworthiness of Interactive Flight Technologies Inc. Interactive Passenger Entertainment System on Swissair MD11 to comply with FAR 25.1529, Instructions for Continued Airworthiness. This document was released on 20 March 1997 and referenced numerous HI drawings and documents. The maintenance instructions contained the following information:

    • General description of the modification
    • Removal and installation procedures for the LRUs
    • Operating, troubleshooting, and servicing information
    • Frequency and extent of the inspection

    Service Bulletins

    Both IFT and HI were responsible for issuing SBs as required.

    Interactive Flight Technologies Inc.

    IFT issued 38 SBs, the majority of which were primarily for system software upgrades, movie and content updates, and for product improvement modifications to IFEN components. Some of the product improvements, each addressed by a separate SB, included the replacement of a single blow fuse with a self-resetting circuit protection switch in the cluster controllers, VOD, seat electronics boxes, and management terminal electronics boxes. None of the IFT SBs were considered directly pertinent to the investigation.

    Hollingsead International

    HI issued 15 SBs for technical changes or improvements to the IFEN system. One SB, applicable by fuselage number to the occurrence aircraft, was considered to be of interest because it involved the installation of additional wiring within the area that was fire damaged in the occurrence aircraft. During the TSB investigators' inspections of Swissair's fleet of MD-11 aircraft, it was observed that the PA wire was installed in various conduits above Galley 2, even though the SB documentation specified the conduit to be used. SB 23-12003-11, Communications-IFT System, PA Key Line Modification, was issued on 2 June 1997 and was applicable by fuselage number to HB-IWF (the occurrence aircraft). HI recommended that this modification, which provided PA audio through the IFEN system, be accomplished during the earliest practical maintenance period. SR Technics could not locate a document referring to this SB, nor was this SB identified in the SR Technics Status List of Engineering Orders. However, HI had performed this modification, at SR Technics facilities, under HI Work Order 67793. An FAA Form 337 was completed by HI on 18 March 1998.

    PA System

    Detail-Specification for Interactive IFE, Section 5, dated 22.7.96 Rev 1, outlined the PA system requirements. These requirements included the need for the PA signal to override all audio channels of the IFEN system and stop all video, audio, and other functions for the selected PA zone(s). The original IFEN system-to-aircraft integration design did not meet this condition; therefore, HI issued SB 23-12003-11.

    Swissair IFEN MM Rev B, issued on 2 September 1997, provided the following information pertaining to the PA system, even though the design was not capable of performing the actions as described:

    When the PA system is operated from one of the flight crew [or flight] attendant positions all IFEN activities are paused, and the messages are broadcast simultaneously over the PA and through the IFEN system headphones.

    Installation Information

    Drawing 50013-103 A/C[1] Systems to G8 Disconnect and Drawing 50024-101 Relay to G8 Disconnect were to be modified to accomplish this SB.

    The SB, with supporting documents, provided the following wire installation information:

    • At the Galley 8 video display unit/relay assembly, install wire WW56-9186-20WH to the new wire run as per Drawing 50013-103/203 (Drawing Change Notice 3186 pg. 4 of 7).
    • Route the wire to the MAR 4 shelf in the E & E bay as per Drawing 20326.
    • Fabricate the 50013-105 wire harness as per the instructions on Sheet 12.
    • Install the harness as per AC 43.13-1A, 2A, the task card, Sheet 6, and the installation drawing on Sheet 10.
    • Route the harness adjacent to the existing cables.
    • The total length of the M22759/34-22-9 22 AWG wire was 107 feet.
    • Fourteen 22 AWG wires were installed.
    • Route the PA wire through conduit ABP7646-51P.
    Discrepancies

    The TSB identified the following discrepancies:

    • Drawing 50013 Rev G (9-23-98) does not identify Drawing Change Notice 3186.
    • Drawing 20023 Rev B shows wire WW56-9186-20WH located only between pin 36 of the relay assembly and pin 6 of plug P1-7322 located above Galley 8, and not continuing to the MAR 4.
    • The instruction to "install harness per AC43.13-1A" does not provide adequate information as to the specific routing of the wire.

    IFEN System Maintenance Records

    All maintenance activities related to the IFEN system were documented in a database. Between the first installation and system deactivation on 28 October 1998, 17 052 discrepancies were recorded for all Swissair aircraft equipped with the IFEN system.

    The collected data included aircraft registration information, "trouble" information, "action" information, "date A/C in," and "date A/C out." "Trouble" referred to the recorded discrepancy and "action" referred to the maintenance activity that was carried out to address this discrepancy. For the purpose of evaluation, the TSB defined four data categories and grouped similar entries into the appropriate category.

    1. Reboot: Entries that made reference to a hard or soft reboot, system reset, or both.[2]
    2. Parts Replace: All scheduled and non-scheduled parts replacements.
    3. Software Related: All upgrades and re-installations.
    4. Maintenance Related: Entries such as "plug installed" and "plug replaced" and equipment repairs.

    A comparison between HB-IWF and a sampling of the other MD-11 aircraft with the same IFEN system configuration is provided below.

    Table: MD-11 IFEN System Configurations

    Aircraft Reg. HB- C-Class[3] Installed Date F-Class[4] Installed Date Total Entries Reboot Parts Replace Software Related Maintenance Related
    IWF 9/97 2/98 620 412 149 23 36
    IWI 10/97 10/97 527 258 193 36 40
    IWE 4/97 3/98 844 500 271 34 39
    IWC 12/97 12/97 629 385 162 14 68
    IWK 1/98 1/98 581 361 184 26 10

    Power Supply Failure

    One incident was reported of an in-flight trip of a PSU CB. This incident occurred on HB-IWL on 30 August 1998. The PSU 2 CB, F9, located in the lower avionics CB panel, tripped and was reset in-flight but tripped again. When maintenance personnel reset the CB, it immediately tripped and a noise was heard in PSU 2. This PSU was subsequently removed and forwarded to IFT for corrective action. The repair estimation report identified the following:

    • The unit recorded 4 347.4 hours on the front panel power meter.
    • Input terminals were shorted.
    • The J1 connector was burnt and numerous traces were destroyed.
    • The aluminum sheet metal in the vicinity of the J1 connector was melted through.
    • Some unidentified metallic residue found in the vicinity of the melted sheet metal appeared to be foreign to the power supply.
    • Additional assemblies within the unit exhibited several burnt traces.

    No detailed examination of the unidentified metallic residue was performed and the reason for the failure was not identified.

    FAA Policy Statement ANM-01-04 – System Wiring Policy for Certification of Part 25 Airplanes

    The FAA released Policy Statement ANM-01-04 on 2 July 2001 to advise applicants for type certificates, amended type certificates, supplemental type certificates, or type design changes on how existing rules, currently contained in 14 CFR, Part 21, are to be interpreted. This notification did not establish any new rules but provided comprehensive guidance on the required elements of a design package and the actions required for compliance. The FAA stated that the policy was necessary to correct deficiencies associated with the submission of design data and instructions for continued airworthiness involving airplane system wiring for type design, amended design, and supplemental design changes. The notification advised applicants of the range and quality of type design data that the FAA expects applicants to submit as part of the certification project.

    The FAA did not intend to establish a binding norm with the general policy stated in this document, nor would the FAA apply or rely upon this document as a regulation. However, the FAA expected that those tasked with the responsibility of aircraft certification should generally attempt to follow the policy, when appropriate.

    It is and has been the FAA's policy to require that type design data packages submitted for multiple approvals[5] include the following elements: a drawing package that completely defines the configuration, material, and production process necessary to produce each part in accordance with the certification basis of the product; any specification referenced by the required drawings; and drawings that completely define the location, installation, and routing, as appropriate, of all equipment in accordance with the certification basis of the product.

    Statement of FAA Policy

    The FAA's Notice of Final Policy, dated 28 January 2002, incorporates changes based on comments received from four sources who responded to the FAA's request for the public to present their views on this policy statement. These changes are identified as footnotes within the applicable section.

    The following statements are extracted from the FAA Policy.

    Unambiguous Definition of Configuration:

    Type design data packages should completely define the certification configuration.[6] Specifically, routing and installation of wiring on the airplane should be addressed. It is important that the routing of wiring strictly follow the intent of the criteria established by the FAA in the certification basis as reflected in the original or subsequently approved type design approval holder's design.[7]

    System Safety Assessment:

    Certain airworthiness criteria require failure analyses (i.e., failure mode and effect analysis, zonal analysis, or other safety analysis) to demonstrate that a failure of the system under consideration:

    • does not, in itself, constitute an unacceptable hazard, and
    • does not result in damage to other systems that are essential to safety.
    Specific Installation Drawings Instead of General References

    The FAA expects the applicant to provide definitive drawings instead of merely statements such as "install in accordance with industry standard practices," or "install in accordance with AC 43.13-1A."[8] The FAA considers such statements as inadequate because the standard practices cannot define the precise location or routing of the wiring.

    Process Specifications and Modifications Compatible with Original Standards

    Certain airworthiness requirements require analysis or tests to define the strength, durability, and life of components associated with the installation of wiring in the aircraft (i.e., connectors, brackets, wire constraints, grommets, ground terminations, etc.). These tests and analyses require complete definition of the parts so that:

    • Conformity of the parts to the type design may be verified, and
    • The characteristics of the parts important for test or analysis may be determined.

    IFE System STC Design/Installation

    The FAA review of a number of recent certification projects identified various problems, many of which were evident in the IFE system certification documentation, including the following:

    • Not completely defining the specific routing and installation of the wiring, which left a portion of the installation to the discretion of the installer.
    • The practice of referencing general guidance, such as AC 43-13 and industry standard practices, which resulted in an incomplete definition of the installation configuration.
    • Instances in which a modifier is unaware, or does not specify installation and routing practices that are compatible with the certification standards established for the original type design, such as installing a power wire for the modification in a wire bundle containing critical wiring that the original manufacturer was required to isolate from other systems.
    • Maintenance aspects of system wire external to the installed equipment are not being adequately addressed. The integrity of the wiring is typically left to those doing general airplane maintenance, which relies on visual inspections.

    [1]    "A/C" means aircraft.

    [2]    "Reset" is defined as "causing a device to return to a former state." Therefore, when a tripped CB is pushed in, it is "reset." "Reboot" is defined as "to boot up a system again." Therefore, when a CB is deliberately pulled and then pushed in (i.e., cycled), it is done to "reboot" the system. Swissair and SR Technics personnel use the terms "reboot" and "reset" interchangeably when they are referring to rebooting the IFEN system software. None of the "reboot" entries identified above are for a "reset" of a tripped CB.

    [3]    "C-Class" refers to business class.

    [4]    "F-Class" refers to first class.

    [5]    ANM-01-04 states: "Multiple approvals are approvals for modifications that may be installed on any airplane of a specific type."

    [6]    ANM-01-04 states: "Type design data packages should meet the intent of 14 CFR part 21.31 (a)."

    [7]    ANM-01-04 states: "It is important that the routing of the wiring follow the intent of the criteria established by the FAA in the certification basis as reflected in the original or subsequently approved type design approval holder's design."

    [8]    ANM-01-04 states: "The FAA expects applicants to provide engineering drawings instead of merely statements such as 'install in accordance with industry standard practices,' or 'install in accordance with AC 43.13-1A.'"

    Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
    Transportation Safety Board of Canada
    Symbol of the Government of Canada

     AVIATION REPORTS - 1998 - A98H0003

    Cabin Safety

    1. Cabin Emergency Preparation/Evacuation Checklist
    2. Reports of Unusual Smells
      1. Unusual Smells on HB-IWF on Previous Flights
        1. HB-IWF Operating as Flight SR 178
        2. Additional Information
        3. Assessment of Link between SR 178 and SR 111: HB-IWF
      2. Unusual Smell on Another Swissair MD-11: HB-IWH
        1. 11 July 1998
        2. 18 August 1998
        3. Assessment of the Link between Unusual Smells on HB-IWH
    3. Reporting and Recording of Abnormal Conditions
      1. Procedures for Cabin Crew
      2. Procedures for Flight Crew
      3. Procedures for Maintenance Crew
      4. General
      5. Reporting and Recording of Abnormal Conditions by SR 178 Crew
      6. Reporting and Recording of Abnormal Conditions by SR 264 Crew

    Cabin Emergency Preparation/Evacuation Checklist

    The Cabin Emergency Preparation/Evacuation checklist specifies the procedures for cabin crew to follow in the event of smoke or fire on board the aircraft. The procedures are as follows:

    • Smoke on board
      • Inform PIC immediately
      • Call another F/A to assist
      • Use protective breathing equipment
      • Investigate reason for smoke
      • Instruct passengers on smoke protection (e.g., to place wet towels over nose and mouth)
    • Fire on board
      • Attack a fire immediately
      • Call another F/A to assist
      • Inform PIC and C/C [cabin crew]
      • Switch off affected electrical system
      • Calm/inform passengers if advisable

    Reports of Unusual Smells

    Unusual Smells on HB-IWF on Previous Flights

    HB-IWF Operating as Flight SR 178

    Approximately three weeks before the accident, an unusual smell was detected by cabin and flight crew on HB-IWF (the occurrence aircraft) operating as SR 178 (Zurich to Hong Kong, China, to Manila, Phillippines), on 10 August 1998.

    Prior to boarding the passengers in Zurich, the first-class galley F/A detected an unusual smell while working in the area of Flight Attendant Station 1.1.[1] Shortly thereafter, the M/C arrived and commented on the unusual smell. A second F/A working in the area also noticed the smell, as did one of the business-class cabin crew. The M/C walked through the entire aircraft cabin and confirmed that the smell was not present elsewhere in the cabin. Cabin crew described the smell as follows: something scorched or burnt, warm rubber, similar to an over-heated electrical appliance, or possibly, some type of gas or chemical with which they were unfamiliar. The smell was first detected when the forward cabin doors were open to facilitate catering. They speculated that perhaps the smell was coming from outside the aircraft. The smell persisted when the doors were closed. The ovens being used to warm the hot towels were checked, but there were no unusual smells. When the ovens were turned off, the smell remained. It was suggested, and the M/C agreed, that the flight crew should be informed of this abnormal condition.

    The M/C asked an FO from the relief crew to investigate. The FO noted a very faint smell described as slightly acrid, similar to the smell produced when an electrical device is used for the first time. The M/C and the FO went to the cockpit and reported their observations to the captain. They checked the aircraft logbook to determine whether any electrical components in the first-class galley had recently been changed. There were no records of such a change. The captain sent a second FO from the relief crew to investigate. He too detected an unfamiliar but very faint smell. The flight crew concluded that the smell would not constitute a problem.

    Shortly before the take-off roll, the first-class galley F/A and the M/C went to the cockpit and advised the captain that although its intensity fluctuated, the smell persisted. The captain was asked to come back to the cabin and assess the situation. The captain did so, and perceived a faint odour of warm plastic between the 1.1 flight attendant jump-seat and the garbage can that is near the edge of the cockpit door when the door is opened 90 degrees. He estimated that the smell was strongest approximately 1 m from the floor. He concluded that the smell was not strong enough to be of concern, did not warrant further investigation, and that the flight would depart as scheduled. The captain instructed the M/C to keep him apprised of the situation. The captain did not enter any information in the aircraft logbook regarding the unusual smell.

    Cabin crew reported that the smell remained for the first six hours of flight, subsided, and reappeared one hour before landing. The smell was described as having been strongest during the final hour of flight. The cabin crew did not convey this information to the flight crew.

    On arrival in Hong Kong, the flight crew and the cabin crew completed their duty day. During deplaning, a cabin crew member met the flying station maintenance engineer, who was providing the maintenance support for—and was scheduled to accompany the flight to—Manila, and told him about the unusual smell on board the aircraft. In response to this information the station engineer

    • opened a quick-access ceiling panel in the area of Flight Attendant Station 1.1 and checked the CBs for abnormalities;
    • remained in the area of Flight Attendant Station 1.1 for the first half hour of the flight to Manila and monitored the situation (but detected nothing);
    • advised the cabin crew working in the area of Flight Attendant Station 1.1 about the smell and asked them to report any abnormalities to him (none were reported); and
    • advised the M/C flying out of Hong Kong to Zurich on HB-IWF (SR 179, 11 August 1998) about the smell.

    As there was no recurrence of the smell, maintenance personnel did not make an entry in the aircraft logbook regarding the actions taken in relation to the reported smell.

    Following the accident of SR 111, it was reported that during SR 179, all of the CBs had been in the normal position, that there were no unusual smells on board HB-IWF, and that no reports of any unusual smells during the flight from Hong Kong to Manila had been reported.

    If there had been an entry in the aircraft logbook regarding the unusual smell, maintenance personnel would have been required to take further action (such as removing panels, including panels around the cabin door, removing the oven(s) and inspecting further in the area of Flight Attendant Station 1.1, or both).

    Cabin Flight Report Regarding Unusual Smell on HB-IWF
    Operating as SR 178

    In August 1998, the M/C who had been on duty during the Zurich-to-Hong Kong leg of SR 178 filed a Cabin Flight Report describing the unusual smell detected on HB-IWF and requesting that the event be investigated.

    Swissair's Response to Cabin Flight Report Regarding
    Unusual Smell on SR 178

    In response to the Cabin Flight Report, Swissair indicated that before take-off in Zurich the plane had been treated with a chemical disinfectant and that remnants of the disinfectant may have led to the smell. The aircraft had just completed a maintenance "A check" and that a chemical, an insecticide known as Ketometrin, was used during this check. SR 178 was the first flight following the "A check," which had been completed only hours before the flight.

    Additional Information

    Following the accident, an interview questionnaire was distributed to approximately 500 flight and cabin crew to determine whether they had experienced any unusual event, including abnormal sounds, smells, or sights in HB-IWF. There were 432 responses received. Other than reports of the unusual smell (with no smoke) on SR 178 on 10 August 1998, there were no reports of unusual smells in the area noted above between August 10 and the occurrence. There were no reports of unusual smells recorded in aircraft records or mentioned during subsequent interviews with 36 flight and cabin crew members who had been aboard the aircraft, including the crew of SR 102, who flew HB-IWF on the flight before the accident flight.

    HB-IWF flew 50 flights between August 10 and the occurrence without any known recurrence of the unusual smell.

    Assessment of Link between SR 178 and SR 111: HB-IWF

    As an unusual smell was reported on the accident aircraft (as Flight SR 178, 10 August 1998) approximately three weeks before the accident, investigators assessed any potential link between that unusual smell and the events on the accident flight.

    Unusual Smell on Another Swissair MD-11: HB-IWH

    On two occasions a "burnt" or "burning" odour was detected on another Swissair MD-11 aircraft: HB-IWH.

    11 July 1998

    On 11 July 1998, a passenger on board HB-IWH operating as SR 111 detected a "strong, nasty odour of something burning. It was not a kitchen smell, but rather something which should not burn." The smell was detected in flight, after meal service, in the area of Passenger Seat 14H. The passenger did not report the unusual smell to the cabin crew during or immediately following the flight.[2] There is no record of anyone else detecting an unusual smell on that flight.

    18 August 1998

    On 18 August 1998, a passenger on board HB-IWH operating as SR 264 detected an unusual smell, described as a burnt odour. The smell was detected prior to take-off in the mid-cabin area at Seat 18J. The passenger, who identified himself as an aircraft maintenance engineer for a major airline, was very concerned and reported the abnormal condition to an F/A. The F/A also smelled a burnt odour and reported the abnormal condition to the flight crew and the M/C. The M/C investigated, but did not smell anything. He reported this to the flight crew. The F/A reported that maintenance personnel boarded the aircraft, adjusted "a nozzle," and advised that the smell would disappear in flight, which it did.

    Neither the F/A nor the M/C completed a Cabin Flight Report concerning the burnt odour. The captain did not make an entry in the aircraft logbook regarding the burnt odour. There were no entries in the aircraft logbook by maintenance personnel to indicate either who had been on board the aircraft or what actions were taken. It could not be determined who had requested maintenance services.

    After learning of the SR 111 accident, an F/A from SR 264 contacted Swissair officials in Zurich to report her recent experience on an MD-11 aircraft. Because the F/A did not know the registration of the aircraft used for SR 264, she was concerned that it might have been the same aircraft as that of SR 111 (HB-IWF). It was not.

    Assessment of the Link between Unusual Smells on HB-IWH

    Given that the same aircraft, HB-IWH, was used for both flights and that on each flight, passengers reported a burnt odour within an area spanning four passenger-seat rows (at passenger seats 14H and 18J, respectively), investigators assessed any potential link between SR 111 (July 1998) and SR 264.

    However, because there are no records or other information indicating the source of the burnt odour on SR 264, and because the passenger from SR 111 (July 1998) only reported the burning smell to the TSB several months after the flight, it was not possible to draw any link between the two events.

    Reporting and Recording of Abnormal Conditions

    Procedures for Cabin Crew

    The Cabin Emergency Manual, Chapter 2.1, "Standard Emergency Procedures," Section 1, General, states that "any abnormal condition, e.g., an explosive or other unusual noise, fire or smoke, must be reported immediately to the commander by the cabin crew member who observed it." An unusual smell is considered an abnormal condition. At the time of the occurrence there was no requirement to record abnormal conditions or perceived unsafe conditions in the cabin logbook. Typically, only technical deficiencies concerning the cabin and the galley were entered in the cabin logbook by the M/C. The cabin logbook would then be presented to the cockpit crew at least 30 minutes prior to landing, at which time the original copy of any entries made were given to the captain, who would subsequently transcribe them into the aircraft logbook.

    The reporting of abnormal conditions or perceived unsafe conditions is also addressed in the General Basics Cabin Crew Manual, Chapter 4.1, "Crew Regulations," Section 2, General, Subsection 2.3, Reporting, as follows:

    [A]ll flight personnel shall report any details, in general or particular, which are considered to be unsafe…. Information about such incidents should be…forwarded via the established company channels…. Remember that non-reporting may be detrimental to safety.

    Additionally, crew members can report any safety-related information through established confidential channels in Swissair.

    Procedures regarding recording of "messages about irregularities of any kind" are contained in the General Basics Cabin Crew Manual, Chapter 4.1, "Crew Regulations," Section 3.2, Cabin Crew Reports. Two types of cabin crew reports are cited: the Quick Report, which addresses service irregularities; and the Cabin Flight Report, which "is to be used for all problems which may not be dealt with on the Quick Report." The messages in these reports are categorized by subject and stored in a data bank.

    A search of the MD-11 Cabin Flight Report database for additional information concerning abnormal smells on board HB-IWF or other MD-11 aircraft since 1997 resulted in only one other report. This report, dated 8 February 1998, concerned a broken reading light in C-class on board HB-IWA. The M/C reported that the CB was pushed twice and a noise and a smell of smoke were noted.

    Cabin crew procedures for reporting and recording abnormal, perceived unsafe conditions, or both are similar for Canadian and United States air carriers. Cabin crew must immediately make a verbal report to the cockpit of any abnormal condition and must complete a written report (often referred to as an In-flight Incident Report).

    Procedures for Flight Crew

    At the time of the occurrence, it was normal practice for one or more members of the flight crew to investigate an abnormal condition reported by a cabin crew member. Subsequently, it was the captain's responsibility to determine whether the abnormal condition constituted a risk to flight safety. The captain would decide whether additional investigation, remedial action, or both were required; when it was to be done; and by whom. If the captain determined that the abnormal condition should be reported to maintenance, an entry was made in the aircraft logbook. If not, no entry was made in the logbook. There was no requirement that the flight crew report every abnormal condition or perceived unsafe condition to maintenance personnel; therefore, there was no automatic requirement for an entry to be made in the aircraft logbook.

    Procedures for Maintenance Crew

    Maintenance personnel must respond to any entry in the aircraft logbook, including entries regarding an abnormal condition, such as an unusual smell. Maintenance personnel must then make a corresponding entry in the aircraft logbook, reporting and recording what rectification action was taken, by whom, and when.

    Maintenance crew were not required to take action in response to information conveyed informally during conversation with a crew member. If maintenance personnel did respond to such information, there was no requirement to make a subsequent entry in the aircraft logbook.

    General

    Cabin crew procedures clearly defined what constituted an abnormal condition. Procedures for reporting such abnormal conditions to the flight crew were clear and concise. These procedures appeared to have been consistently followed by members of the cabin crew.

    Cabin crew procedures for recording such abnormal conditions did not state clearly when a written Cabin Flight Report was required. It was left to the discretion of the F/A whether the abnormal condition was "considered to be unsafe." What one F/A considered to be an unsafe condition might not be considered unsafe by another F/A. Given these procedures, the number of Cabin Flight Reports submitted, and the subjects they addressed, may not have accurately represented the presence of abnormal conditions within the system.

    At the time of the occurrence, the flight crew procedures regarding the recording of abnormal conditions reported to them by cabin crew allowed for discretion by the flight crew. Abnormal conditions would have been recorded in the aircraft logbook at the captain's discretion.

    Reporting and Recording of Abnormal Conditions by SR 178 Crew

    Because the M/C of SR 178 considered the unusual smell an abnormal or suspicious condition, he submitted a Cabin Flight Report regarding the abnormal condition, as per procedure. Reporting of the abnormal condition was at the discretion of the flight crew; had the M/C not submitted a Cabin Flight Report, no record of any abnormal condition would have existed.

    Reporting and Recording of Abnormal Conditions by SR 264 Crew

    The SR 264 cabin crew reported an abnormal condition, specifically a burnt odour, detected on board the aircraft to the flight crew as per procedure. In light of the fact that the burnt odour went away following take-off, neither the F/A who initially reported the smell nor the M/C considered the burnt odour to have been an unsafe condition. Therefore, neither submitted a Cabin Flight Report, nor were they required to do so. At his discretion, the captain made no entry in the aircraft logbook regarding the burnt odour. Had the F/A involved not called Swissair following the accident of SR 111, there would have been no record of a burnt odour on a second MD-11 aircraft.


    [1]    The area of Flight Attendant Station 1.1 includes the L1 cabin door, the flight attendant jump-seat, and Galley 1.

    [2]    TSB was advised of the "burning smell" in a letter from the passenger. The TSB subsequently advised Swissair; a search of their records for HB-IWH operating as SR 111 on 11 July 1998 revealed no record of any smell having been reported.

    Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
    Transportation Safety Board of Canada
    Symbol of the Government of Canada

     AVIATION REPORTS - 1998 - A98H0003

    IFEN – Companies and Agencies Involved
    in the IFEN Project

    1. Swissair
    2. SR Technics
    3. US Federal Aviation Administration
    4. Swiss FOCA
    5. Interactive Flight Technologies Inc.
    6. Hollingsead International
    7. Santa Barbara Aerospace
    8. Recaro and Rumbold
    9. McDonnell Douglas Corporation (now Boeing)

    Swissair

    Swissair, a scheduled airline operating under JAR OPS 1 Commercial Air Transportation (Aeroplanes) as of 1 April 1998, contracted with IFT to install a passenger entertainment system in its fleet of MD-11 and B-747 aircraft.[1]

    On 10 October 1996, Swissair accepted an offer, dated 2 September 1996, known as the September 1996 Offer, from its technical services department to coordinate and oversee the installation.[2] The on-aircraft installation was carried out by HI. IFT was also a signatory to this document.

    SR Technics

    Located in Zurich, Switzerland, SR Technics is an approved maintenance organization under the JAR/FAR, Part 145. SR Technics performed aircraft and engine overhaul and maintenance.

    Under the September 1996 Offer, SR Technics was responsible for providing logistical support to, and QA oversight of, HI. As part of its QA role, SR Technics was responsible for monitoring the installation work performed by HI.

    As an approved repair station, SR Technics was responsible for releasing each aircraft to return to service following installation of the IFEN system. Each such release was based on receipt of the FAA Form 337 (Major Repair and Alteration) provided by HI following installation of the IFEN system. SR Technics Engineering Order 513051, which relates to the installation of the IFEN system in accordance with STC ST00236LA-D on HB-IWF (the occurrence aircraft), was completed on 12 September 1997.

    IFT entered into an agreement with SR Technics in which SR Technics was subcontracted to provide the ongoing product support for the IFEN system for which IFT was responsible in accordance with its Sales and Services Agreement with Swissair.[3]

    US Federal Aviation Administration

    The LAACO of the FAA provided regulatory oversight of SBA, which acted as the certifying organization on behalf of the FAA. The FAA was also responsible for the ongoing oversight of SBA as a DAS(STI) The FAA approved SBA's LOI to certify the IFEN system.

    The FAA did not consider HI to be exercising its repair station authorization in support of STC ST00236LA-D. However, the FAA was responsible for the ongoing oversight of HI as an approved repair station and holder of an FAA Parts Manufacturer Approval.

    Swiss FOCA

    As the regulatory authority in Switzerland, the Swiss FOCA had the authority to certify the IFEN installation in Swissair aircraft. The FOCA did not, however, issue a separate STC, but accepted the FAA STC ST00236LA-D and the use of Form 337.

    FAA AC43.9-1E states:

    FAA Form 337 is not authorized for use on other than US-registered aircraft. If a foreign civil air authority requests the form, as a record of work performed, it may be provided. The form should be executed in accordance with the FAR and this AC. The foreign authority should be notified on the form that it is not an official record and that it will not be recorded by the FAA Aircraft Registration Branch, Oklahoma City, Oklahoma.

    Although Form 337 is not typically used in Switzerland, this method was acceptable to the FOCA.

    Interactive Flight Technologies Inc.

    Located in Phoenix, Arizona, IFT developed and supplied the IFEN system. IFT was an approved repair station under the 14 CFR, Part 145, Certificate I9TR42N, issued on 16 May 1996 and held an FAA PMA for IFEN system components. IFT did not perform any work under its repair station authority in support of this STC.

    Swissair contracted with IFT to install certified IFEN shipsets in its MD-11 and B-747 aircraft. IFT was also to install and operate the shipsets.[4]

    IFT provided support for the IFEN system by supplying parts, providing software updates, issuing SBs, providing training, implementing product improvements, and addressing system-related problems. IFT also created the IFEN Maintenance Manual, which provided maintenance and trouble-shooting instructions and removal and installation procedures for the IFEN components.

    Hollingsead International

    HI was an approved repair station under the 14 CFR, Part 145, Certificate H51R428J, issued in 1953 and held an FAA PMA for the IFEN system wire bundles and equipment racks. HI facilities were located in Santa Ana and Garden Grove, California.

    IFT contracted with HI to perform the IFEN certification, system integration engineering, and installation. HI manufactured the wire bundles, equipment racks, and structural supports necessary for installing the IFEN system. HI also created the Maintenance Instructions for Continued Airworthiness for the IFEN system, (STI) which included a general overview of the installation and basic removal and installation procedures for the IFEN system components. All installation work was accomplished by HI personnel at SR Technics facilities in Zurich, Switzerland.

    Santa Barbara Aerospace

    Located in Santa Barbara, California, SBA was an approved repair station under the 14 CFR, Part 145, Certificate S3BR755J, issued on 27 July 1994. SBA was also an approved DAS under the 14 CFR Part 21, Certificate DAS-14-NM, issued on 11 August 1994. SBA did not exercise its repair station authority in support of this STC.

    HI contracted with SBA to provide the certification services necessary to obtain an STC. SBA did not perform any design or installation functions in support of the STC. SBA performed all certification activities, including approving data to demonstrate compliance with applicable regulations, test witnessing, drawing review, and parts and installation conformity activities.

    Recaro and Rumbold

    Located in Steinbeisweg, Germany, Recaro supplied the first- and economy-class seats. Located in Camberley, United Kingdom, Rumbold supplied the business-class seats. The seat manufacturers installed the IFEN system components into their respective seats under contract to IFT. This was accomplished under STC ST01373AT, a separate STC.

    McDonnell Douglas Corporation (now Boeing)

    The manufacturer of the aircraft was not directly involved in either the design or the installation of the IFEN system. On 26 July 1996, SR Technics asked MDC to provide specific aircraft data that would allow HI to integrate the system into the MD-11. MDC provided the requested data.

    MDC was not requested to review the system design or integration, or to provide an NTO. An NTO was not required by regulation for this project.[5]


    [1]    Prior to 1 April 1998, Swissair was operating exclusively under Swiss FOCA authority.

    [2]    The technical department of Swissair became an autonomous company known as SR Technics under the SAirGroup of companies on 1 January 1997. For the purposes of this report, the name SR Technics will be used to refer to both entities.

    [3]    The agreement between IFT and SR Technics, General Terms and Conditions for the Product Support Program In-Flight Entertainment System, became effective on 1 August 1997.

    [4]    An IFEN shipset is an IFEN hardware system that, when loaded with appropriate software and program material, has or performs the following functions: exhibition on demand of motion pictures, short audio/video selections, video games, and gaming (all pursuant to and more fully set forth in Swissair's Detail-Specification for Interactive Inflight Entertainment & Cabin Management System (IFE) on Swissair's MD-11 and B-747).

    [5]    An NTO represents a superficial appreciation of a project's impact on the manufacturer's product. It does not constitute manufacturer or FAA approval.

    Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
    Transportation Safety Board of Canada
    Symbol of the Government of Canada

     AVIATION REPORTS - 1998 - A98H0003

    IFEN – Description

    1. Product 97
    2. Product 99
    3. System Description
    4. Components
      1. Introduction
      2. Line Replaceable Units
        1. Disk Array Unit
        2. Power Supply Unit
      3. Electromagnetic Interference Filter Box
      4. Cabin File Server
      5. Seat Electronics Box
      6. Seat Disconnect Unit
      7. Head-End Distribution Unit
      8. Dual Audio Gameport
      9. In-Seat Video Display
      10. Cluster Controller
      11. Network Switching Unit
      12. Video on Demand
      13. 32-Channel Modulator
      14. 13-Channel Modulator
      15. Management Video Display
      16. Management Terminal Electronics Box
      17. Video Distribution Unit
      18. Printer
    5. General
    6. Network Architecture

    Product 97

    The IFEN system was installed in the business- and first-class passenger sections of HB-IWF in August and September of 1997, while the aircraft was undergoing a Heavy Maintenance Visit ("D check"). Although the 49 IFEN-equipped business-class seats were installed during this time, the first-class seats were not installed until February 1998 owing to delivery delays.

    SR Technics produced EO 513051, "Installation of the IFE[1] System," for the IFEN installation. The EO included the following instructions:

    • Installation of the IFE system will be performed by Hollingsead according to MDL 12003-501.
    • Testing of the IFE system will be performed by Hollingsead according to MDL 12003-501.
    • After installation and test of the IFE system, Hollingsead will provide the FAA Form 337 to SR Technics for the aircraft release.

    HI completed FAA Form 337 for HB-IWF on 9 September 1997 for the installation of the IFEN system in accordance with HI MDL 12003-501, as per STC ST00236LA-D, dated 7 August 1997. MDL 12003-501 was applicable to Swissair's MD-11s equipped with 257 passenger seats.

    SR Technics' Status List of Engineering Orders identified EO 513051 as being carried out, dated 12 September 1997.

    Product 99

    In February 1998, as part of Swissair's Product 99 modification, the following work was completed:

    • The first- and business-class seating arrangement was re-configured;
    • The newly acquired IFEN-equipped first-class seats were installed; and
    • The number of economy-class seats was reduced from 196 to 178.

    This work was accomplished by SR Technics personnel under SR Technics' EO 511525, "C Configuration Change from Version 1124 to M1130." The seating configuration for both Product 97 and Product 99 was such that each had 12 first-class and 49 business-class seats; however, they differed in the layout of the seating plan. The modifications associated with Product 99 contained several changes, including configuration changes for the PA and cabin telephone systems. HI's involvement in the Product 99 modification was limited to making adjustments to the IFEN system cabling, located on the cabin floor, to accommodate the new seating arrangement. HB-IWF was removed from service for two days, 20 and 21 February 1998, to carry out this and other scheduled work.

    SR Technics' Status List of Engineering Orders for HB-IWF identified EO 511525 as being carried out, dated 4 June 1998.

    Product 99, as applicable to HB-IWF, included the following SR Technics' EOs:

    Table: SR Technics EOs

    EO Description Date
    Performed[2]
    511525 New Cabin Configuration Version M1130 4 June 1998
    513185 PA Reconfiguration for Product 99 23 February 1998
    513184 CTS [Cabin Telephone System] Reconfiguration for Product 99 23 February 1998
    513173 Mux [Multiplexer] Reconfiguration Mid Zone P99 23 February 1998
    513175 Video Reconfiguration Fwd Zone P99 23 February 1998
    513179 LCD on Y/C Centre Bagrack Inst P99 23 February 1998
    513170 Mux Reconfiguration Fwd Zone P99 23 February 1998
    511509 EA [energy absorbing] Partition Installation/Relocation 23 February 1998
    511527 Adapt Interior Finish Change for Version M1130 23 February 1998
    511526 First-Class Partition Relocation/Installation 23 February 1998
    511602 Centre Bagrack Endcap - LCD Monitor Install 23 February 1998
    510363 Gasper Air Panel Assemblies Modification 23 February 1998
    510368 Air Conditioning Duct Attachment 23 February 1998
    510356 Cabin Version Change - Mod. of O2 Boxes 23 February 1998
    510362 Removal of Electrical Wires in Forward Cabin 23 February 1998
    513178 Video Re-configuration P99 System Test - 1130 23 February 1998
    513174 Mux Programming and Test Version 1130 23 February 1998
    217194 Product 97 F-Class Seat Power Installation 23 February 1998
    217215 Product 99 Eco + C/Y class Pax Reading Light Relocation 23 February 1998
    217096 Product 99 Split of Cabin Ceiling Lights 23 February 1998
    514000 Manufacture Cabin Floor Panels for Product 99 23 February 1998

    SR Technics EO 511525 did not identify a requirement for the FAA Form 337. Nevertheless, HI provided one for HB-IWF on 21 February 1998 for the installation of HI's Product 99 Cabin Configuration (239 passenger) installation kit in accordance with MDL 12007. The drawings referenced on this form were applicable to the MD-11 installation; however, the MDL was incorrectly identified as 12007. MDL 12007 was applicable to the IFEN installation in Swissair's Boeing B747 aircraft. HI has stated that the installation in HB-IWF was carried out under the applicable MDL; however, a typographical or bookkeeping error was made when completing the FAA Form 337.

    HI's Product 99 cabin configuration installation kit, as installed in HB-IWF, was carried out under MDL 12003-501. Although this MDL was previously applicable to the 257-passenger-seat configuration, it had subsequently been revised to reflect Swissair's new interior configuration of 239 passenger seats. On the basis of an economic evaluation, Swissair chose to install the IFEN system in only the first- and business-class seats. HI accomplished this by using the STC approved documentation that was applicable to the 239-seat configuration with the exception of installing the components and cabling required for the economy-class seating.

    System Description

    The IFEN system, using Windows NT® 4.0, combined computer, video, and audio. It allowed passengers to select, through an ISVD, various functions, including movies, audio, games, news, gambling, and a moving map display. Each ISVD received broadband audio and video signals carried by the Broadcast Distribution Network. Additionally, each ISVD received and transmitted digital data over a LAN that encompassed several displays. The ISVD could also receive and send information to any other component of the IFEN system, by sending messages through the CC.

    Power consumption for the IFEN system, as installed in HB-IWF, was 4.4 kVA supplied from the 115 V AC Bus 2 and 0.2 kVA supplied from the 115 V AC ground services bus. The DC loads were less than 20 W.

    Components

    Introduction

    The major hardware components were mounted above the ceiling in electronic racks (referred to as E-racks). These racks were approximately 100 inches long and comprised seven bays, Bay 1 being the forward-most. E-rack 1 was located in first class, above the right aisle, with its forward support located at FS 647. E-rack 2 was located in economy class, above the left aisle, with its forward support located at FS 1429. HB-IWF was also equipped with the cabling and structural supports to accommodate a third E-rack. These supports were located above the right aisle in economy class, directly opposite E-rack 2.

    The relay assembly, located above Galley 8, was the system control unit that encapsulated all of the external interfaces to the aircraft system. These interfaces included the decompression signal, PA system over-ride signal, and 28 V DC power. Additionally, the relay assembly provided control over the 48 V DC power output to the IFEN system. The decompression signal removed PSU power from the IFEN system upon cabin decompression. The PA system over-ride signal was designed to stop all audio and video on the IFEN system whenever the PA was used.

    Line Replaceable Units

    Disk Array Unit

    HB-IWF had one DAU installed in Bay 6 of E-rack 1.

    The DAU contained a bank of seven 9 GB HDDs, which stored the digitally encoded movies, assorted video segments, and audio programming. The seven HDDs worked together as a disk array; should one fail, the array automatically uses the additional copies of the information stored on the other disks. The DAU sends the movie and music data using small computer system interface format to the VOD unit upon receiving the request from the UNC (not an acronym), which is incorporated within the VOD unit. The power input requirement was 48 V DC at 4.7 A.

    Power Supply Unit

    HB-IWF had four PSUs installed. PSU-1 and PSU-2 were located in bays 1 and 2 of E-rack 1. PSU-3 and PSU-4 were located in bays 6 and 7 of E-rack 2. All PSUs were interchangeable.

    The PSU received 115 V AC three-phase 400 Hz input from the aircraft AC Bus 2 and, by utilizing a series of capacitors and internal electronics, provided 48 V DC output power used by the IFEN system components.

    Electromagnetic Interference Filter Box

    HB-IWF had four EMI filter boxes installed, one attached to the top side of each of the PSUs. All EMI filter boxes were interchangeable.

    The EMI filter box used inductors, capacitors, and other internal electronics to filter out conducted EMI radiation between the aircraft supply and the PSUs.

    Cabin File Server

    HB-IWF had one CFS installed, located on a shelf in the middle of Galley 8.

    The CFS was the collection point for the credit card data transmitted from each seat. The CFS also controlled the download of movies, through the VOD, for storage on the DAU; it stored flight and casino information; and it controlled the IFEN system's operation by sending a signal to enable the IFEN system. It also connected to the MVD terminal. During flight, the SEBs and CCs communicated their status to the CFS, and the CFS built a statistics file. The CFS included

    • a motherboard with a Pentium 166 MHz processor;
    • a 9 GB HDD partitioned into two logical drives:
      • a 1 GB partition, C:\ operating system,
      • an 8 GB partition, D:\ core software and data storage; and
    • 64 MB of RAM.

    The CFS outputs data to a removable disk pack, which was the interface for extracting flight and credit card data and for uploading new data to the IFEN system, and which had a parallel port for output to a printer. The power input requirement was 48 V DC at 3.1 A.

    Seat Electronics Box

    HB-IWF had 61 SEBs installed, one under each of the first- and business-class passenger seats. All SEBs were interchangeable.

    The function of a SEB was to process all information for the passenger interface and display, including video, audio, and display data. Data inputs could be in the form of baseband video and audio through an SDU, plus passenger credit card information, touchscreen data, and game controller data from the passenger seat assembly. The power input requirement was 48 V DC at 0.42 A. The SEB included

    • a custom motherboard with a Pentium 100 MHz processor;
    • a 340 MB HDD;
    • 32 MB of RAM;
    • 16-bit "Soundblaster"; and
    • video graphics array controller.

    Seat Disconnect Unit

    HB-IWF had 28 SDUs installed, one under each set of first- and business-class seats and one installed behind E-rack 2. All SDUs were interchangeable.

    Each SDU contained the tuners and network repeater for each of its associated SEBs. Data inputs were broadband RF from an HDU and "Ethernet 10BaseT, Inter-Integrated Circuit" signals from a CC. The SDU split the Ethernet and RF signals for relay to each of its associated SEBs. The output signals from the SDU were

    • baseband video and audio;
    • 48 V DC to feed the SEB power;
    • Ethernet signals to the SEBs; and
    • 48 V DC broadband RF and Ethernet signals for the next SDU along the chain.

    The SDU also housed audio processing equipment. The power input requirement was 48 V DC at 0.25 A.

    The SDU installed behind E-rack 2 supported the two MVDs and MTEBs.

    Head-End Distribution Unit

    HB-IWF had two HDUs installed. Both were mounted on the underside of
    E-rack 1, one in each of bays 3 and 4. All HDUs were interchangeable.

    The HDU combined the separate video and audio outputs from a modulator, injected a pilot carrier frequency for the SDU automatic gain control, and split the output four ways to provide input to four SDUs. Data input was RF signals from a modulator via an RF splitter. HDU output was RF signals to the associated SDUs, with all channels carrying the video and audio signals. The power input requirement was 48 V DC at 0.007 A.

    Dual Audio Gameport

    HB-IWF had 61 dual audio gameports installed—one in the armrest of each first- and business-class passenger seat. All dual audio gameports were interchangeable.

    Each dual audio gameport had two external connections: a mini-DIN connector for the game controller device (mouse) and a matched set of jacks to mate with the two-pronged headphone jack. Game control and audio were transmitted between the individual SEBs and the gameport, while the gameport communicated with the passenger touchscreen and sent audio signals to the passenger's headphone set. The power input requirement was 5 V DC at 0.5 A.

    In-Seat Video Display

    HB-IWF had 61 ISVDs installed, one in each armrest compartment between each pair of seats in the first- and business-class passenger sections. All left-hand ISVDs were interchangeable and all right-hand ISVD were interchangeable.

    The ISVD was an integrated unit that combined a touchscreen, a magnetic card reader, and a 10.4-inch diagonal LCD. The LCD is a thin-film transistor with a resolution of 640 X 480 dots and "True Colour" capability. There were on-screen buttons to make video and audio selections via the SEB. The power input requirement was 5 V DC at 2 A.

    Cluster Controller

    HB-IWF had six CCs installed. All were mounted on the underside of
    E-rack 1, two each in bays 5, 6, and 7. All CCs were interchangeable.

    Each CC managed one SEB cluster network by coordinating all the network administrative tasks. The core software linked each SEB network to the CFS. The power input requirement was 48 V DC at 0.42 A. The CC included

    • a custom motherboard with a Pentium 100 MHz processor;
    • a 340 MB HDD; and
    • 32 MB of RAM.

    Network Switching Unit

    HB-IWF had one NSU installed, located in Bay 1 of E-rack 2.

    The NSU is the hub for the IFEN administrative network. It provides network links for the CFS, CCs, UNC (integral to the VOD), and MTEB. The power input requirement was 48 V DC at 2 A.

    Video on Demand

    HB-IWF had one VOD, installed in Bay 5 of E-rack 1.

    The VOD extracted the movie and music data from the DAU, performed the MPEG decoding, and passed it on to the RF modulators. The VOD could support two DAUs and functioned in an IFT proprietary processing environment. The audio-on-demand was a function incorporated within the VOD, essentially using the VOD capabilities to select and distribute audio. The power input requirement was 48 V DC at 5.3 A. Each VOD included

    • 8 embedded-processor MPEG decompression cards;
    • 8 processors per card; and
    • 64 video streams.

    The UNC, which was incorporated within the VOD, was responsible for the coordination of the embedded processors; it handled the interface with the IFEN administrative network and the core software. The UNC included

    • a Pentium 100 MHz processor;
    • a 340 MB HDD; and
    • 32 MB of RAM.

    The VOD was also equipped with a removable disk pack, which was the interface for uploading movie data.

    32-Channel Modulator

    HB-IWF had two 32-channel modulators installed. Both were mounted in
    E-rack 1, one in each of bays 3 and 4. All 32-channel modulators were interchangeable.

    The modulators converted the baseband video and audio from the VOD to broadband RF and transmitted (distributed) the RF signal through the HDUs to the SDUs for display on the ISVDs at the passenger seats. Two modulators were used per VOD, one for odd-channel modulation and the other for even-channel modulation. There was no resident software in these modulators. The power input requirement was 48 V DC at 3.3 A.

    13-Channel Modulator

    HB-IWF had one 13-channel (common) modulator, installed in Bay 7 of
    E-rack 1.

    The common modulator performed the same function as the 32-channel modulator. It converted the baseband video from the VOD to broadband RF and transmitted (distributed) the broadband video to the SDU for display on the ISVDs at the passenger seats. The common modulator was used to distribute video and audio common to the entire aircraft, such as the moving map system and videotape reproducers. There was no resident software in this modulator. The power input requirement was 48 V DC at 1.5 A.

    Management Video Display

    HB-IWF had two MVDs installed, one in each of galleys 1 and 8. Each MVD was mounted on the bulkhead, facing the rear of the aircraft.

    The MVD provided an interface to the IFEN system for cabin crew and maintenance personnel. It connected to the administrative network and served as a point of control for configuring, maintaining, and monitoring the IFEN system. The MVD was an integrated unit that combined a touchscreen, a magnetic card reader, and a 10.4 inch diagonal LCD. The LCD was a thin film transistor with a resolution of 640 X 480 dots and "True Color" capability. There were on-screen buttons to make selections, and data input came from the MTEB. The power input requirement was 5 V DC at 2 A.

    Management Terminal Electronics Box

    HB-IWF had two MTEBs installed, one in the upper portion of each of galleys 1 and 8.

    The MTEB was the primary functional component interface to the IFEN system by the cabin crew and maintenance personnel. The power input requirement was 48 V DC at 0.42 A. The MTEB included

    • a Pentium 100 MHz processor; and
    • a 340 MB HDD.

    Video Distribution Unit

    HB-IWF had two video distribution units installed—both behind an overhead panel in front of Galley 8, between FS 735 and FS 755. Access to these units was through the flat overhead panel in front of Galley 8.

    The video distribution unit permitted video signals to be broadcast simultaneously on the IFEN system and on aircraft video equipment, such as the overhead monitors. The video distribution unit had two separate video inputs, one from the Air Show unit and one from the aircraft video system (e.g., Safety Video). The power input requirement was 28 V DC at 0.15 A.

    Printer

    HB-IWF had a standard commercial full-format printer. This was located on a shelf in Galley 8.

    The printer was connected to the CFS and was used to print a variety of reports for passengers and for maintenance. It provided 300 dots per inch at a speed of 120 to 180 lines per minute. The power input requirement was 115 V AC at 400 Hz.

    General

    System performance was achieved by clustering sets of passenger interface processors on a local network where the CC handled master system-level network administration and traffic for its collection of processors. The use of specialized digital signal processing software was limited to the areas of in-stream high-rate video signal processing. This was necessary for effective VOD data storage and retrieval. The design concept allowed the effective use of standard operating systems and network protocols in the architecture. The user interface processing capability and the touch screen control and display device simplified passenger use. The IFEN system interfaced with other standard cabin subsystems such as videotape reproducers and moving map systems. Centralized database management and overall system control was accomplished by the CFS on the primary system administrative network.

    Network Architecture

    The IFEN's fast Ethernet-type WAN was centrally controlled by the CFS. The CFS controlled several CCs and each CC could control up to 32 ISVDs. All the CCs are interconnected with the CFS in the top-level administrative WAN. The hub of the WAN was the NSU. The NSU maximized the data throughput of the WAN by providing an intelligent switching matrix which routed data packets between the CCs, VODs, and the CFS. Since the CFS resided on the administrative network, database updates used a "store and forward" technique from the CC, rather than real-time links to the CC or MVD.

    The Swissair IFEN Maintenance Manual, dated 2 September 1997, stated that "the failure of the CFS is not critical to the operation of the WAN, since each CC will continue to operate autonomously without the CFS, and none of the ISVDs will be affected."

    Each CC was interconnected with its ISVD in a low-level ethernet-type LAN. Each LAN operated independently of all the other low-level LANs on the aircraft. Consequently, the failure of an individual ISVD would have no effect on the operation of the rest of the ISVDs on the aircraft. Additionally, the failure of an individual CC would only affect that CC's ISVDs.


    [1]    IFE is used when describing generic in-flight entertainment systems.

    [2]    Date Performed as identified in SR Technics Status List of Engineering Orders for HB-IWF.

    Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
    Transportation Safety Board of Canada
    Symbol of the Government of Canada

     AVIATION REPORTS - 1998 - A98H0003

    IFEN – FAA Certification and Delegation Process

    1. Background
    2. Designated Alteration Station
    3. STC Application and Approval Process
    4. STC Roles and Responsibilities
      1. Aircraft Certification Office
      2. Manufacturing Inspection District Office
      3. Aircraft Evaluation Group
    5. DAS Oversight Function
    6. Aircraft Certification Systems Evaluation Program
    7. Santa Barbara Aerospace
      1. SBA/ACO Relationship
      2. FAA Oversight of SBA
        1. LAACO Engineering Evaluation of SBA
        2. FAA ACSEP Evaluation of SBA

    Background

    The IFEN system modification of the Swissair MD-11 aircraft was accomplished under the authority of the Swiss FOCA. The FOCA's acceptance was based on the FAA's STC ST00236LA-D. An FAA-approved STC can be accepted by the FOCA under the terms of two bilateral agreements between Switzerland and the US: the Bilateral Airworthiness Agreement, signed 13 October 1961; and the Bilateral Aviation Safety Agreement, signed 26 September 1996.

    Designated Alteration Station

    In 1965, the FAA established a delegation structure that authorized eligible, private-sector organizations to perform certification services on behalf of the FAA. The DAS is not delegated authority in areas that are reserved for FAA approval. DAS certificate holders are appointed and monitored through a regional ACO. The LAACO was responsible for appointing and monitoring SBA, the DAS responsible for the IFEN STCs installed in the Swissair MD-11 and B-747 fleets.

    To be eligible to become a DAS, a company must

    • be an authorized repair station under the 14 CFR, Part 145; an authorized air carrier under the 14 CFR, Part 121; or an authorized manufacturer of a product for which it has alteration authority under the 14 CFR, Part 43.3(i);
    • have adequate maintenance facilities and personnel in the US to operate and maintain the products under its certificate;
    • employ or have available a staff of engineering, flight-test, and inspection personnel who can determine compliance with the applicable airworthiness requirements; and
    • employ at least one staff member (referred to as the DAS Coordinator) who possesses
      • a thorough working knowledge of the applicable requirements,
      • the authority to establish alteration programs that ensure altered products meet the applicable requirements,
      • at least one year of satisfactory experience in direct contact with the FAA while processing engineering work for type certification or alteration projects,
      • at least eight years of aeronautical experience, and
      • the general technical knowledge and experience necessary to determine that altered products of the types for which a DAS authorization is requested are in condition for safe operation.

    Each DAS applicant must prepare an FAA-approved DAS manual that complies with the requirements contained in the FAR, Part 21, Subpart M, Section 21.441.

    The FAA-approved DAS manual must contain

    • procedures for issuing STCs;
    • the names, signatures, and responsibilities of officials and of each staff member; and
    • the identity of those persons with the authority to perform the following tasks:
      • Make changes to procedures that require a revision to the DAS manual,
      • Conduct conformity and compliance inspections,
      • Approve inspection reports,
      • Prepare or approve data,
      • Plan or conduct tests,
      • Approve the results of tests,
      • Amend airworthiness certificates,
      • Issue experimental certificates,
      • Approve changes to operating limitations of Airplane Flight Manuals, and
      • Sign supplemental type certificates.

    A DAS appointment remains in effect until it is either surrendered by the DAS or it is suspended, revoked, or otherwise terminated by the FAA.

    STC Application and Approval Process

    The DAS must follow the certification procedures contained in FAA Order 8110.4A, which was subsequently replaced by FAA Order 8110.4B. This order prescribes the responsibilities and procedures for FAA aircraft certification personnel responsible for the certification process required by the FARs for civil aircraft, aircraft engines, and propellers. The type certification process described in FAA Order 8110.4A applies to type certificates, amended type certificates, and STCs.

    An STC is issued for major design changes to type-certified products when the change is not extensive enough to require a new type certificate. To request an STC, the applicant submits an STC application (FAA Form 8110-12) to the responsible ACO. The ACO assigns each new STC project a number and a manager, and notifies the accountable directorate.

    To obtain STC approval from the FAA, an applicant must demonstrate compliance with the applicable certification requirements for the aircraft. It is the applicant's responsibility to develop and provide the required data.

    The FAA will issue an STC when all of the following requirements are met:

    • All pertinent technical data have been examined and found satisfactory.
    • All necessary tests and compliance inspections have been completed.
    • The alteration conforms with the technical data.
    • The FAA determines that the design change meets the applicable regulations.

    A DAS is authorized to evaluate and approve STC applications and issue STCs on behalf of the FAA in accordance with FAA Order 8110.4A and other FAA requirements. Procedures for evaluating and approving STCs are outlined in the DAS manual. Prior to issuing an STC, however, the DAS must provide the following information to the ACO:

    • The type of design change, including any novel or significant features;
    • The applicable airworthiness requirements;
    • The proposed methods for meeting the applicable requirements, including ground- and flight-test requirements;
    • A determination by the DAS that the applicant has met each applicable airworthiness requirement;
    • Indication that the DAS is satisfied that the type of product for which the STC is to be issued, as modified by the supplemental type design data upon which the STC is based, is properly designed for safe operation; and
    • A list of manuals to be issued or revised.

    The DAS submits this information to the ACO in an LOI outlining the scope of the project.[1] Within 30 days of issuing the STC, the DAS administrator must submit the following information to the ACO:

    • Two copies of the STC;
    • One copy of the design data approved by the DAS and referred to in the STC;
    • One copy of each inspection and test report;
    • Two copies of each revision of the AFM or of the operating limitations; and
    • Any other information necessary for safe operation of the product.

    STC Roles and Responsibilities

    The FAA's STC responsibilities are managed at the directorate level by the ACO. The ACO is responsible for identifying the scope of the certification project and for designating and organizing the appropriate FAA resources (e.g., the MIDO, the AEG, etc.) to ensure that the STC applicant has demonstrated compliance with the applicable regulations.

    Aircraft Certification Office

    All STC projects are reviewed by the ACO. Depending on the complexity of the project, the ACO may require the assigned FAA team to conduct a coordinated review process.

    In addition to conducting an FAA engineering compliance evaluation, the ACO's review of the LOI involves FAA MIDO and AEG specialists.

    Manufacturing Inspection District Office

    The MIDO is an organization within the Aircraft Certification Service. In fulfillment of its responsibilities, the MIDO

    • conducts airworthiness certification of civil aircraft, engines, propellers, parts, and appliances;
    • approves production and conducts surveillance of aviation manufacturing facilities;
    • supports FAA engineering personnel during type certification programs;
    • investigates enforcement reports of non-compliance to the FAR; and
    • investigates service difficulties.

    The MIDO provides these services primarily through conformity inspections. A conformity inspection is required to ensure that the product and the installation to be certified complies with the type design. In the case of an STC, the MIDO provides the required conformity inspections at the request of FAA engineering personnel. It is the responsibility of FAA manufacturing inspectors, designated manufacturing inspection representatives, or designated airworthiness representatives to determine whether the product conforms with drawings, specifications, and special processes. An FAA conformity inspection should be successfully conducted before any official FAA tests (ground or flight) are conducted.

    Aircraft Evaluation Group

    FAA Order 8110.4A states that AEG personnel are co-located within each directorate and are responsible to the Flight Standards Aircraft Evaluation Program staff manager. The AEG is responsible for determining operational acceptability and ensuring that maintenance requirements are met for continued airworthiness for newly certified or modified aircraft. Operations and airworthiness inspectors have the primary responsibility for evaluating the aircraft and its systems for operational suitability and continued airworthiness.

    The AEG conducts operational and airworthiness evaluations in accordance with FAA Order 8110.4A, Type Certification Process. During the type certification process, the AEG analyzes the type data and participates in the aircraft certification engineering compliance inspections and flight programs. The AEG then makes recommendations to the ACO regarding operations specifications.

    In fulfillment of its responsibilities, the AEG

    • evaluates operational suitability;
    • reviews the maintenance program;
    • reviews the flight manuals and revisions;
    • participates in functional and reliability testing;
    • manages the Flight Operation Evaluation Board, Flight Standard Boards, and Maintenance Review Boards; and
    • serves as a member of the Type Certification Boards and the Flight Manual Review Boards.

    More specifically, FAA Order 8110.4A, Chapter 4, paragraph 27(h) states that with respect to STCs, the AEG should be involved in the areas of operational suitability and ICA of aircraft that have incorporated STC modifications that would affect operational suitability and continued airworthiness (i.e., change in crew requirements, changes in flight instrument displays, minimum equipment list relief, and changes that would affect FOEB, FSB, and MRB reports).

    The scope of the AEG's responsibilities is detailed in FAA Orders 8430.21A and 1100.5B. These orders state that the Manager, Aircraft Certification Division and the Manager, Flight Standards Division of regions with directorates are jointly responsible for ensuring a close liaison between the appropriate ACO and the AEG concerning assigned type certification projects involving applications for original, supplemental, or modified aircraft type certificates. This close liaison must begin in the early stages of the type design approval program and continue throughout the service life of the aircraft. The managers must also ensure that the aircraft manufacturers and modifiers, particularly those with DAS authority, recognize that the operational evaluations conducted by the AEG are an integral part of the overall certification process and that provisions must be made for AEG personnel to have access to and participate in certain certification phases of new, modified, follow-on aircraft models. Certification and evaluation activity schedules must be coordinated between the ACO and the AEG prior to initiating an agreement with the manufacturer.

    DAS Oversight Function

    The FAA is responsible for supervising and monitoring DAS programs. The LAACO employs an Aviation Safety Specialist, who, along with a team of FAA engineers, inspectors, and pilots, oversees each DAS within his or her jurisdiction. This position is unique to the LAACO; other ACOs may not employ an Aviation Safety Specialist as a facilitator.

    To manage a DAS, the FAA team

    • ensures that the DAS has the most current documentation (annually);
    • verifies DAS representation at Designee Standardization Seminars;
    • discusses DAS performance with authorized representatives (ongoing);
    • ensures appropriate corrective action is taken;
    • ensures that the DAS contacts the ACO prior to issuing special airworthiness certificates and participating in any type certificate or STC activities;
    • reviews the project at start and completion (ongoing);
    • ensures that the DAS coordinator communicates directly with DAS management authorities;
    • coordinates with the DAS to provide regular updates of designee activity (ongoing);
    • reviews completed project records on a sampling basis (annually);
    • witnesses the inspection of at least one completed product to ensure that satisfactory inspection techniques are being used (annually); and
    • documents all monitoring and supervision activities (ongoing).

    In addition to the above activities, the FAA advises that the responsible team also

    • conducts, on a biannual basis, a systematic review of manufacturing processes and conduct an engineering inspection of at least one completed project to ensure that satisfactory certification criteria and techniques are being used;
    • participates in compliance findings in areas involving known safety-related problems; and
    • makes determinations, through ongoing liaison, in areas reserved for the FAA, such as regulatory interpretations and equivalent safety findings.

    Aircraft Certification Systems Evaluation Program

    The FAA's ACSEP (FAA Order 8100.7A) was chartered by the Certifications Procedures for Products and Parts, 14 CFR, Part 21. The ACSEP was developed in the mid-1990s to replace existing FAA industry audit programs that were perceived to be falling short of providing the kind of information required in the modern and sophisticated aviation industry environment. The formal incorporation of DAS facilities into the ACSEP occurred on 24 July 1997.

    Unlike its predecessors, the ACSEP was designed, with industry input, to evaluate many different types of facilities using modern, consistent, and standardized evaluation criteria.

    The ACSEP is used to determine whether a facility is complying with the applicable FARs and its own FAA-approved procedures. An ACSEP evaluation also assesses a facility against standardized industry practices that may not be covered by the FARs. The collection of data under the ACSEP enables the FAA to not only assess an individual facility, but also to compile the data to identify national trends that may require the development of new or revised regulations, policies, or guidelines.

    Any inconsistency (known under the ACSEP as an "issue") discovered during an ACSEP evaluation is classified by its type and recorded under the subsystem under which it is noted. There are five issue types:

    1. Safety finding: an issue that compromises immediate continued operational safety.
    2. Systemic finding: a systemic issue that represents a breakdown in the quality management system; non-compliance with a FAR or with FAA-approved data.
    3. Systemic observation: systemic non-compliance with non-FAA approved facility procedures.
    4. Isolated observation: non-systemic, isolated non-compliance with a FAR or with FAA-approved data.
    5. FAR-based observation: a discovery of FAA-approved data that are inconsistent with the FARs.

    There are 17 subsystems under which an issue can be further classified. Each subsystem is further divided into "criteria." The subclassification of issues into detailed criteria is designed to enable the FAA to identify specific areas of concern and allow the industry to focus corrective actions on those areas. This detailed classification system is part of the ACSEP's quality management system.

    Facilities that fall under the ACSEP are categorized into two evaluation frequencies depending on the type of facility: 24 and 48 months. Delegated facilities are in the 24-month category. Evaluation frequencies can be shortened to where the FAA is confident that the facility is complying with the applicable FAR. These decisions are based on facility performance.

    At the conclusion of an ACSEP evaluation, a post-evaluation conference is held with the managers of the evaluated facility at which time any issues, findings, or observations are reviewed. Any findings that require formal corrective action are followed up by the FAA. Requests for corrective action are forwarded through a Letter of Investigation. A corrective action is closed through FAA Form 8100-5, Results of ACSEP Evaluation Findings.

    Santa Barbara Aerospace

    SBA was eligible to become a DAS owing to its status as a repair station under the 14 CFR, Part 145, and was the holder of Air Agency Certificate S3BR755J, issued on 27 July 1994. SBA was an authorized DAS under 14 CFR, Part 21, subpart M, certificate DAS-14-NM, issued on 11 August 1994 by the FAA LAACO. In its capacity as a DAS, SBA performed certification services on behalf of the FAA in accordance with FAA Order 8110.4A and other FAA requirements.

    Many SBA staff members were former employees of Elsinore Aerospace and Southern California Aviation, a subsidiary of Aerotest. These companies were also DAS certificate holders. SBA retained FAA-approved DAS staff members for the various disciplines needed to comply with the FAA-approved SBA DAS manual.

    SBA had in its employ, or had available, a staff of engineers and flight-test and inspection personnel who were responsible for determining compliance with applicable airworthiness requirements. The SBA DAS Coordinator possessed all of the required qualifications defined in the FAR, Part 121, Section 21.439(b)(1) through (5).

    In order to carry out its delegated duties, SBA was organized and managed in accordance with the SBA FAA-approved DAS manual. The manual is central to the DAS's ability to perform its delegated FAA duties. This manual included, but was not restricted to, the following items:

    • A listing of authorized representatives and their authorized functions, responsibilities, and limitations;
    • A description of the procedures used in performing authorized functions;
    • A sample of the forms to be used to indicate inspection acceptance or findings; and
    • Changes that require revision to the DAS manual (such as personnel changes) that must be submitted to and approved by the FAA.

    SBA/ACO Relationship

    Like any other DAS, SBA was considered an extension of the FAA. Through their DAS Coordinator, SBA maintained a close working relationship with the engineering and maintenance staff of the LAACO. SBA averaged 20 STC projects annually. Over time, the LAACO staff established a confidence level in SBA's ability to perform the required certification functions. The quality of certification services provided by SBA was monitored by an FAA oversight program.

    FAA Oversight of SBA

    In addition to the project-by-project contact between SBA and the LAACO, the FAA was responsible for conducting formal audits of the SBA. In accordance with FAA Notice N8130.68, Designee Supervision, Monitoring and Tracking, the LAACO was required to conduct a DAS engineering evaluation of SBA in order to verify that the DAS Coordinator possessed all of the required documentation and to review completed project records. The first such evaluation was conducted between 18 and 22 March 1996. This audit identified numerous areas of non-compliance with the FAR and with the FAA-approved SBA DAS manual. In response to the FAA observations, SBA was required to provide written comments to the FAA addressing the corrective action(s) to be taken.

    Beyond the annual DAS engineering evaluation conducted by the LAACO, SBA was audited under the auspices of the FAA's ACSEP. The SBA's first ACSEP evaluation was conducted between 5 and 7 May 1998. The ACSEP evaluation revealed several findings and observations related to design data approval, conformity inspections, and airworthiness certification. The FAA was satisfied with the corrective action outlined by SBA to deal with the findings of the ACSEP report.

    LAACO Engineering Evaluation of SBA

    On 20 May 1996, the LAACO forwarded a letter to SBA outlining the FAA findings of the FAA engineering evaluation of SBA between 18 and 22 March 1996. The letter documented information that had already been discussed between the two parties at the time of the evaluation. In the FAA letter, SBA was complimented on the professional attitude of its staff, the level of cooperation the SBA staff exhibited toward the FAA, and the interest of the SBA staff in maintaining a high standard of aviation.

    The FAA engineering evaluation consisted primarily of an FAA team review of the DAS-issued STC data files. The FAA team searched the SBA files to verify adherence to the FAA-approved SBA DAS manual and compliance with the applicable FARs.

    The FAA team reviewed 19 SBA STCs in the course of the engineering evaluation. All 19 STCs included findings described as either "non-compliance" or "observation"; none of the findings were categorized by the FAA as posing a particular threat to flight safety. The FAA team also commented on discrepancies in the FAA-approved SBA DAS manual. Again, there were no observations that were deemed to pose a threat to flight safety.

    In keeping with standard practice for such engineering evaluations, SBA was invited to provide the FAA with written comments addressing the corrective measures that SBA would undertake with regard to the instances of non-compliance and the observations. SBA forwarded its response to the FAA in a letter dated 30 December 1996. Each instance of non-compliance and observation was addressed individually. The response was either an acknowledgement or acceptance by SBA of the FAA comment, or an explanation by SBA of their original position or action with the implication that in the SBA's opinion, the original position or action was acceptable.

    One observation in the FAA engineering evaluation concerning the SA9008NM-D Inflight Telephone (DC-9-82) stated the following:

    No Type Inspection Authorization (TIA) was found in the data file to address the Electro Magnetic Interference (EMI) flight test that was performed.

    The SBA response letter addressed this FAA observation as follows:

    A TIA is only issued when the test to be conducted may have a substantial impact to the aircraft. This has been coordinated through ANM-160L (TSB note - ANM-160L is a position in the FAA LAACO Flight Test Branch). The typical "non-essential" electronics that are being installed do not impact the operation of the aircraft.

    On 20 May 1997, the FAA responded by letter to the SBA submission. In this letter, the 18-22 March 1996 FAA engineering evaluation was concluded as follows:

    Our staff has reviewed your responses to each of our findings and concur with your reply. This letter concludes the evaluation.

    FAA ACSEP Evaluation of SBA

    The FAA conducted an ACSEP evaluation of SBA between 5 and 7 May 1998, and documented their findings in a report dated 7 May 1998. The FAA team documented five findings and one observation:

    • Two of the findings were recorded in the Design Data Approval subsystem, neither of which were deemed by the FAA to pose a threat to flight safety.
    • Two findings and one observation were recorded in the Conformity Inspection subsystem. There were no findings or observations that were deemed by the FAA to pose a threat to flight safety.
    • One finding was recorded in the Airworthiness Certification subsystem. This finding was deemed by the FAA as not posing a threat to flight safety.

    Two documents address the follow-up action resulting from the ACSEP evaluation. The first is a letter to the FAA from SBA dated 2 September 1998 outlining an action plan by SBA to address the ACSEP findings and observations. The second is a letter to SBA from the FAA (date-stamped 28 September 1998) acknowledging the SBA action plan. In the 28 September 1998 letter, the FAA states that the SBA action plan is acceptable, that the case can be considered closed by Letter of Correction, and that the case may be reopened in the event that the agreed corrective action is not carried out.


    [1]    The term "Program Notification Letter" was introduced in FAA Order 8100.9, DAS, DOA, and SFAR 36 Authorization Procedures to replace the term "LOI."

    Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
    Transportation Safety Board of Canada
    Symbol of the Government of Canada

     AVIATION REPORTS - 1998 - A98H0003

    IFEN – FAA STC ST00236LA-D Reviews Following SR 111 Accident

    1. FAA Critical Design Review Trip Report
    2. ACO STC Briefing Report
    3. FAA Special Certification Review

    FAA Critical Design Review Trip Report

    The FAA, along with SBA personnel, conducted a CDR of SBA's STC ST00236LA-D on 16 October 1998. The CDR team consisted of four certification specialists who spent approximately four hours reviewing the technical compliance data included in STC ST00236LA-D.

    The CDR was completed, in part, to answer questions posed by the SR 111 investigation team. The investigation team requested specific information pertaining to the electrical bus to which the IFEN was connected, including whether it was a cabin bus, and if not, why not. The initial CDR incorrectly stated that the IFEN was located on a cabin bus. Based upon this erroneous information, the CDR team concluded that the STC complied with the applicable FARs.

    ACO STC Briefing Report

    On 2 November 1998, the TSB submitted a letter to the FAA advising the organization that the SR 111 investigation team was interested in potential safety issues concerning the IFEN installation and the certification of the system. The TSB also requested that the FAA provide a report from a second planned review of the STC by the FAA.

    The LAACO submitted Briefing Report Rev 1, dated 6 November 1998, to the TSB. This report answered questions posed by the TSB, the NTSB, and the FAA. The document provided background information on the STC and corrected the CDR finding regarding the source of electrical power to the IFEN. The document confirmed that the IFEN system was not connected to a cabin bus. This report also referred to the IFEN system as a "non-essential passenger entertainment system." The Briefing Report Rev 1 also indicated that the FAA had submitted a letter to SBA on 29 October 1998 advising the organization that the FAA was planning an SCR of STC ST00236LA-D.

    FAA Special Certification Review

    The FAA formed an SCR team to investigate the design, installation, and certification of the IFEN system installed on the Swissair MD-11 aircraft. The objectives of the SCR were to determine whether the IFEN system included any unsafe design or installation features and to review the practices of SBA with respect to their approval of the subject STC, including the FAA's oversight of SBA. The SCR was led by the FAA Seattle Transport Airplane Directorate, and was conducted in three phases beginning on 9 November 1998 and concluding on 29 January 1999. The SCR team produced a report dated 14 June 1999 (amended on 9 June 2000 to include the "Implementation Activity for the SCR Recommendations" section).

    Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
    Transportation Safety Board of Canada
    Symbol of the Government of Canada

     AVIATION REPORTS - 1998 - A98H0003

    High-Intensity Radiated Fields

    1. General
      1. Electromagnetic Theory
      2. HIRF Frequency Domain
      3. HIRF Power Calculations
        1. Basic Physical Concepts
        2. Energy Density
        3. Radiation and Penetration of HIRF
      4. Standing Waves
      5. Resonance
        1. Aperture Resonance
        2. Cavity Resonance
        3. Antennas
      6. Disruptions to Avionics
      7. Aircraft Avionic System HIRF Protection
    2. MD-11 Aircraft Certification Standards
      1. FAA/JAA Special Conditions
      2. Supplemental Certification of In-Flight Entertainment System
      3. HIRF Hazard Assessment
    3. Representative Emitters
      1. AEGIS Cruiser – SPY-1 Air Surveillance and Tracking Radar
      2. Air Route Surveillance Radar
      3. Airport Surface Detection Equipment
    4. SR 111 Electromagnetic Environment
      1. Criteria for High-Intensity Emitters
      2. Mobile Emitters
      3. Fixed Emitters
    5. Barrington HIRF Environment
      1. Barrington Radar Power Calculations
      2. Energy from Background Sources
      3. Lightning
    6. HIRF Emitters of Significance to SR 111
    7. HIRF Determination

    General

    Electromagnetic Theory

    A changing electric field produces an induced magnetic field. Similarly, a changing magnetic field produces an induced electric field. This relationship between electric and magnetic fields causes the propagation of transverse electromagnetic waves, in which oscillating electric and magnetic fields are oriented perpendicular to each other and also to the direction of propagation. Electromagnetic waves are radiated whenever charged particles are accelerated. RF electromagnetic waves, with frequencies extending from approximately 10 kHz to 100 GHz, may be produced by electrically oscillating free electrons back and forth within a conducting material. Higher-frequency electromagnetic waves, such as infrared, ultraviolet, visible light, X-rays and Gamma rays result from thermal excitation of orbital electrons (heat) or quantum state changes at the atomic and nuclear level. The earth is continuously exposed to electromagnetic energy from the sun, which imparts approximately 1 400 W of power per square metre (W/m2) to the upper atmosphere, attenuated to about 220 W/m2 at sea level.

    Electromagnetic waves in the RF spectrum are used to convey analogue and digital information. This information is typically encoded by modulating the frequency, amplitude, or phase characteristics of the carrier wave. Some RF signals, such as those normally produced by radar systems, are pulsed to facilitate the measurement of distance between the transmitter and the target. Modern aircraft radiate and receive RF signals in the atmosphere surrounding the aircraft and through electrically conductive RF cabling within the aircraft. In addition, the electrical potential difference (voltage) between wire pairs is used to support binary communication protocols between various electronic systems.

    The electric field component of an electromagnetic wave exerts a force on charged particles and, particularly in electrically conductive material, may cause a net flow of free electrons along the field gradient. This mechanism facilitates the coupling of external electromagnetic energy, occurring in free space, to electrical cables within an aircraft structure. When modulated RF waveforms are being used to convey information along these cables, coupling can distort the original waveform and disrupt the normal functions of electrical and avionics systems. This is especially true in highly integrated systems, where individual LRUs are interconnected by shared data and power distribution buses. These buses provide common pathways through which coupled electromagnetic energy may concurrently influence multiple discrete electronic devices. Disruptions may also occur within the flight recorders, or LRUs, when free space electromagnetic radiation passes through an opening (aperture) in the LRU case and impinges on the junctions of semiconductor components or couples directly to the conductive paths on printed circuit boards. The reflective cavity defined by the metal housing of a typical LRU may exacerbate this effect by producing standing waves with localized field gradients that exceed the maximum field gradient of the incident radiation.

    In addition to the functional disruptions discussed above, other consequences may result from the exposure of an aircraft to extreme electromagnetic field gradients, such as those associated with lightning activity.[1] Under these conditions, the electrical field strength in some region of an aircraft may become sufficiently great to induce an electrical discharge between narrowly separated conductors, by stripping electrons from the substance that occupies the gap between the conductors (ionization). Physical damage to electrical components, pyrolysis, or both of surrounding materials may occur. As well, the thermal energy released by an electrical spark, or a sustained electrical arc, may be sufficient to ignite nearby flammable materials.

    The electric field strength required to induce an electrical discharge between proximate conductors is influenced by the dielectric properties of the substance in the intervening gap, the shape and width of the gap, the shape and texture of the conducting surfaces, pressure altitude, and to a lesser extent, ambient temperature. The breakdown voltage for gaps involving pointed or irregularly shaped electrodes may also vary with frequency, although reliable data for electromagnetic waveforms above 100 MHz is not widely available.

    In general, the breakdown voltage between conductors, separated by a gas, is a non-linear function of the product of gas density and electrode separation.[2] When the product of gas density and electrode separation is less than approximately 1 000 torr cm, corresponding to a maximum gap distance of roughly 1 cm at one atmosphere, the breakdown voltage function is approximated by the following, empirically derived expression:[3]

    Vbreakdown = B x p x d / ( C + ln( p x d ) )

    For air, B = 365 Vcm–1 torr–1, C = 1.18, p = pressure (torr), d = gap distance (cm)

    This function yields a minimum breakdown voltage in air of 327 V, which occurs at 0.567 torr cm.[4] Taking sea level pressure to be 760 torr, and the potential difference between electrodes to be 327 V, an electrical discharge would not occur until the gap separation was reduced to 7.9 x 10–4 cm. A more realistic gap spacing of 0.05 cm, at sea level pressure, gives a breakdown voltage of about 2.6 kV, corresponding to a field gradient of 52 kV/cm. Generally speaking, localized ionization and sparking between proximate conductors, at sea level, is unlikely to occur until the field gradient around the conductors exceeds about 31 kV/cm, irrespective of conductor geometry and surface characteristics.[5]

    Within the pressurized area of a commercial aircraft, the pressure altitude rarely exceeds 8 000 feet. Because the relationship between gap breakdown voltage and pressure is approximately linear, the corresponding minimum breakdown voltage at 8 000 feet (565 torr) is approximately 243 V and the breakdown voltage for a 0.05 cm gap is approximately 1.93 kV. The minimum field gradient necessary to produce localized ionization and sparking between proximate conductors is about 23 kV/cm.

    When considering the potential consequences of an electrical discharge occurring between exposed conductors, a reasonable worst-case scenario would be when the gap between the conductors is occupied by a flammable fuel-air mixture.[6] Theoretical and experimental results suggest that a minimum energy of approximately 0.2 mJ must be imparted to the conductors to induce ignition.[7] However, the corresponding field strength and energy density in free space must be higher, since inherent in the process of electromagnetic coupling is a loss of energy.

    For electromagnetic energy originating from sources external to an aircraft, the amount of energy coupled to internal components is attenuated, in a two-step process, by several orders of magnitude.[8] Attenuation first occurs at the metal skin of a conventional aircraft, which reflects some of the external electromagnetic energy back into the atmosphere. The amount of energy that penetrates to the interior of an aircraft, primarily through the windows and doors, is significantly reduced. In transport aircraft, for example, the ratio between external and internal electromagnetic field strengths ranges from 2 to 40, depending on the location within the aircraft and the RF.[9] Finally, the residual electromagnetic energy that penetrates to the internal spaces of an aircraft may subsequently couple to electrically conductive material, such as wiring or circuit board traces within an LRU, in which case further attenuation will occur at the outer boundary of the material.[10]

    Extraneous electromagnetic energy can originate within an aircraft, from inadequately shielded aircraft components or personal electronic devices, and from sources external to the aircraft, such as lightning and military or civilian radar systems. By convention, internal sources are referred to as EMI and external sources are referred to as HIRF.

    HIRF Frequency Domain

    The HIRF frequency domain has been defined by the Society of Automotive Engineers AE4R committee to extend from 10 kHz to 18 GHz. The lower portion of this spectrum, extending from 10 kHz to approximately 400 MHz, is dominated by weakly directional, continuously transmitting radio and television broadcast signals, exhibiting peak and average power levels that are similar in magnitude. Above 400 MHz, the HIRF frequency spectrum is principally occupied by highly directional radar systems and satellite command and control links. These systems are capable of producing peak and average power levels that are significantly higher than those produced by emitters operating below 400 MHz.

    For load conditions typical of wire runs within commercial aircraft, electromagnetic coupling to aircraft wiring is most efficient at frequencies between 1 and 400 MHz. As well, aircraft windows provide less RF shielding at frequencies greater than approximately 30 MHz. For these reasons, HIRF frequencies in the kHz and GHz range must be one or two orders of magnitude greater than a HIRF signal in the 30 to 400 MHz range to achieve the same amount of coupling onto wire runs within an aircraft. In general, electromagnetic coupling to aircraft wiring and conduction into the avionics LRUs is less efficient at frequencies above 1 GHz.

    The electronic circuit susceptibility within aircraft electrical and electronic LRUs also varies with frequency. At high frequencies, in the GHz range, the electronic circuits tend to have low-pass characteristics, and reject the energy in this range. In addition, rectification of the higher frequency RF energy is not as efficient as at lower frequencies. The RF coupling, penetration, and electronic circuit susceptibility all contribute to the electrical and electronic system vulnerability. These factors tend to result in maximum vulnerability for frequencies that range from 2 MHz to 400 MHz. Below 2 MHz, the RF fields do not couple efficiently to the aircraft and aircraft wiring. Above 400 MHz, the circuits do not efficiently convert the RF energy to cause system effects.

    HIRF Power Calculations

    The propensity for an aircraft to be adversely affected by HIRF is influenced by the frequency of the HIRF signal, the susceptibility of the aircraft to HIRF at the same frequency, the amount of shielding provided to internal components by the aircraft's structure and electrical design, and the RF power to which the aircraft is exposed. Since frequency susceptibility and RF shielding are essentially fixed quantities, power is the principal variable in assessing the risk associated with HIRF emissions within a given range of frequencies.

    Basic Physical Concepts

    Free Space Radiation

    The "far field" region of an antenna begins at a distance equal to twice the square of the maximum antenna dimension divided by wavelength (2d2/l), and it extends to infinity. When the distance between a transmitter and receiver satisfies the far field criteria and the path between them is free of obstructions, the energy is assumed to radiate isotropically—uniformly from the transmitting antenna in a spherical pattern. For high-powered radar systems capable of generating significant HIRF environments, the far field assumption is generally valid at ranges greater than 1 nm.

    Power Density

    The power density (S) at an aircraft within the far field region of a transmitting antenna is equal to the transmitter EIRP divided by the surface area of a sphere centred on the transmitter:

    S = (10EIRP/10)/(4pr2) mW/m2

    when (r) is the distance, in metres, between the transmitting and receiving antennas, and EIRP is expressed as a decibel ratio[11] to a reference level of one milliwatt, denoted dBm.

    Expressed in decibels, the power density is

    S = EIRP – 20 log10r – 10.99 dBm/m2

    when EIRP is expressed in dBm and distance (r) is expressed in metres.

    Electric Field Strength

    The electric field strength (E) is derived from the power density through the following relationship:

    E = (S 120p)½

    when E is expressed in V/m, 120p is the impedance of free space in ohms (377 ohms), and S is power density expressed in W/m2.

    Peak and Average Power

    For a pulsed RF emitter, the average power output is equal to the product of the peak transmitter power (PT), the pulse width (PW), and the pulse repetition frequency.[12] This value can be used to calculate the average power density and the average electric field strength.

    Energy Density

    The energy density (D) generated by a pulsed emitter in free space is defined as

    D = S PW

    when D is expressed in J/m2, S is expressed in W/m2, and PW is expressed in seconds.

    Radiation and Penetration of HIRF

    Antenna Gain

    An isotropic antenna radiates equally in all directions. The gain of an antenna (PG) in a given direction is the ratio of the power density produced by it in that direction to the power density that would be produced by an isotropic antenna.[13] Antenna gain, relative to an isotropic antenna, is frequently expressed in decibels using the unitless designation, dBi (decibels isotropic). Antenna gain is reciprocal in nature; the transmit gain and receive gain are the same. The amount of power captured by an antenna is the product of power density and antenna gain.

    EIRP

    The EIRP of an RF emitter is determined by the transmitter output power, the transmit antenna gain, and any losses that may occur between the transmitter and the antenna. Following adjustments for internal losses, the EIRP becomes the product of PT and PG, or the sum of PT and PG when both values are expressed in decibels.

    Aperture Area

    Unlike the metal skin of an aircraft, which tends to reflect HIRF away from an aircraft, window apertures are more transparent to HIRF. The MD-11 has 71 windows on either side of the fuselage, each with an area of about 0.11 m2; the total window area is approximately 7.86 m2 on each side of the aircraft. For external RF radiation that is incident upon the side of the fuselage, the maximum energy that may enter the aircraft through the windows is the product of energy density and the total window area. The MD-11 passenger and cargo doors also tend to behave like electromagnetic apertures, because the doors do not have continuous electrical contact with the door frames around the door perimeter. These doors have a total area of approximately 17.32 m2 on each side of the aircraft, although the equivalent RF aperture size is substantially smaller.[14]

    Standing Waves

    When a travelling wave is reflected back upon itself, the incident and reflected wave energy will combine to form spatially stationary nodes of destructive and constructive interference, the aggregate waveform constituting a "standing wave." A closed cavity, a length of wire, or the perimeter of an aperture offer geometries where multiple reflections can occur resulting in peak amplitudes that are larger than the peak amplitude of the incident wave. Since the energy of a wave is proportional to the wave amplitude, a standing wave has the capacity to intensify the energy density of the original wave.

    Resonance

    Reinforced wave phenomena, or resonance, will occur on a wire (or the metal shielding around a wire) when its electrical length is an odd integer multiple of the incident radiation ¼ wavelength. The critical frequency defines the lowest frequency where resonance conditions can exist.[15] At all frequencies above the critical frequency, the wire exhibits alternating resonant and anti-resonant conditions.

    Under conditions of resonance, the relatively high energy of a standing wave can distort the voltage waveform on the conductive core of a wire. Fortunately, power and signalling frequencies[16] are much lower than the frequencies associated with HIRF interference. Low pass filters can therefore be used to shield avionics from HIRF-induced interference.[17] In practice, most aircraft avionics are designed to operate with power input variations that will exceed the variations caused by HIRF. RTCA/DO-160C, Section 16, gives the normal and abnormal power input variations that avionics must tolerate without disruption. The avionics input power is filtered to account for these variations.

    Aperture Resonance

    Aperture resonance first occurs when the perimeter of an aperture is equal to the incident radiation ½ wavelength. As with the wire, resonance periodically recurs at higher frequencies, exhibiting broad nodes and narrow nulls. As a general rule, electromagnetic energy is efficiently transferred through an aperture at all frequencies above the critical (½ wavelength) frequency. At lower frequencies, corresponding to wavelengths more than 10 times longer than the aperture perimeter, electromagnetic radiation is attenuated by at least one order of magnitude (10 dB) as it passes through the aperture.[18] For this reason, aircraft windows provide effective shielding against low frequency HIRF, but are essentially transparent to HIRF radiation above 30 MHz.

    Aperture effects may also be observed on LRU cases, which feature holes for cabling and ventilation and which may exhibit long, narrow seams along access panels. A 15 cm long seam has a critical frequency of approximately 1 GHz. Therefore, HIRF energy at 100 MHz will be attenuated by at least 20 db as it passes through this seam. However, electromagnetic energy at frequencies above 1 GHz will pass through the same seam with no attenuation. For this reason, and for mechanical integrity, flight-critical avionics LRU enclosures incorporate closely spaced mechanical fasteners, overlapping seams, and electrically conducting gaskets to attenuate higher frequency HIRF energy.

    Cavity Resonance

    Cavity resonance conditions exist when the length of a cavity is equal to the incident radiation ½ wavelength. Cavity resonance for LRUs of standard dimensions occurs between 1 and 3 GHz. In theory, cavity resonance can increase the peak signal strengths within an LRU by up to 14 dB.[19] In practice, the enclosures for avionics tend not to exhibit a strong dependency to the LRU cavity resonances. This occurs because the LRUs are normally tightly packed with electronics, which makes the cavity complex. These complex cavities do not efficiently support the fundamental enclosure cavity resonant conditions.

    Antennas

    Antennas are designed to receive RF energy in specific frequency ranges and to conduct this RF energy to the radio or radar receivers in the aircraft. HIRF energy in the appropriate frequency range that enters an antenna is, therefore, not attenuated, but is instead subject to the gain characteristics of the antenna. Standing waves are unlikely to develop because the impedance of RF components from the antenna to the receiver are carefully matched to minimize standing waves. HIRF energy outside the appropriate frequency range for the antenna and the receiver will be attenuated significantly.[20]

    Aircraft radios are designed for operation at frequencies assigned in accordance with national and international RF spectrum allocations. These RF spectrum allocations are developed to ensure that authorized high-power RF sources will not interfere with aircraft radios and radars. If an unauthorized HIRF source were to operate within the assigned frequency range for an aircraft radio, the radio receiver would only be affected by HIRF in the frequency range to which the receiver was tuned.

    HIRF energy within the appropriate frequency range will normally be demodulated and amplified, along with the intended RF waveforms, within the receiver. In this way, HIRF energy may distort or corrupt legitimate signals and generally degrade the quality of reception, although some modulation types are more resilient than others. It must be emphasized, however, that RF receivers are designed to operate effectively across a wide range of dynamic signal strength. Received signals are therefore subject to gain control, to maintain an upper bound on the amount of energy that is output from the amplification chain. For this reason, HIRF energy that enters an antenna will not be amplified to unsafe levels by the receiver.

    Disruptions to Avionics

    Digital devices incorporate frequency sources, or clocks, for the timing and control of internal digital functions. Aircraft avionics use digital devices that are specifically qualified for aircraft use. These digital devices tend to have slower processor and data bus clock speeds than modern consumer electronics.[21] For aircraft flying today, the avionics processor and data bus clock speeds range from 2 MHz to approximately 300 MHz. The bandpass region for a digital device extends from the clock speed to approximately 10 times the clock speed.

    HIRF interference that appears within the bandpass of a digital device may be interpreted as a legitimate control signal, driving the device into unpredictable states. HIRF interference that is not within the bandpass of the digital device may be rectified by components of the digital circuit, such as diodes. The interference will then appear as a DC offset on the control signal, triggering uncommanded state changes or locking the device into one state. Some failure modes may not be readily apparent to the operator. It is more likely, however, that error detection circuitry will detect the corrupted control signal(s), in which case error messages will be generated and system degradation will occur in a relatively controlled manner.

    In the RF spectrum, digital circuits may be disrupted by potential differences ranging from 0.4 to 1.2 V. Analog circuits can be sensitive to induced gradients as small as 50 mV, although this latter value is largely dependent on the gain characteristics of the affected circuitry. However, monitoring circuits on analog systems and error detection algorithms in digital systems are normally able to detect HIRF interference before a major upset occurs. Power supply disconnects are the most common response to HIRF interference.

    Aircraft Avionic System HIRF Protection

    Given the electromagnetic coupling effects and the potential avionic system susceptibility, aircraft flight-critical avionics systems and installations must be designed to withstand the effects of HIRF. The designs incorporate HIRF protection within the LRU, on the interconnecting wires, and in the interconnecting wire routing. Avionics designs include filtering and circuit designs that reduce the effects of HIRF energy that may couple into the wiring or LRUs. The LRU enclosures are designed to minimize HIRF coupling directly through openings and seams in the enclosure. The interconnecting wires are shielded and routed through areas that are protected from direct HIRF illumination. The standards for demonstrating the HIRF protection are described below.

    MD-11 Aircraft Certification Standards

    FAA/JAA Special Conditions

    Since the mid-1980s, regulatory authorities have required that newly certified aircraft and modified aircraft demonstrate an acceptable level of aircraft systems protection from the effects of HIRF. The MD-11 certification was subject to special conditions imposed by both the US FAA[22] and the multinational JAA.[23] An operational HIRF environment and associated test procedures were developed to satisfy the FAA and JAA special conditions for MD-11 certification.

    Table: FAA/JAA Operational HIRF Environment for MD-11 Certification

    Frequency Band Field Strength (V/m)
      Peak Average
    10–500 kHz 80 80
    500–2000 kHz 80 80
    2–30 MHz 200 200
    30–100 MHz 33 33
    100–200 MHz 33 33
    200–400 MHz 150 33
    400–1000 MHz 8 300 2 000
    1–2 GHz 9 000 1 500
    2–4 GHz 17 000 1 200
    4–6 GHz 14 500 800
    6–8 GHz 4 000 666
    8–12 GHz 9 000 2 000
    12–20 GHz 4 000 509
    20–40 GHz 4 000 1 000

    These conditions and test procedures applied to aircraft systems that were designated as either critical or essential to the safe operation of the aircraft.

    Table: MD-11 Certification Critical and Essential Systems – HIRF Certification
    System Classification
    Inertial Reference Unit - 1 Critical
    Air Data Computer - 1 Critical
    Display Electronics Unit - 1 Critical
    Display Unit - 1 Critical
    Mode Select Unit Critical
    Instrument Landing System - 1 Essential
    Cabin Pressure Controller - 1 Essential
    Annunciator Control Unit - 1 Essential
    Forward Cargo Compartment Temperature Controller Essential
    Fire Detection Controller (Engine 1) Essential
    Cargo Fire Control Panel Essential
    Fuel System Controller Essential
    Environmental System Controller Essential
    Miscellaneous System Controller Essential
    Flight Management Computer - 1 Essential
    Flight Control Computer - 1 Essential
    Air Conditioning Controller - 1 Essential
    Air Traffic Control Transponder - 1 Essential
    Hydraulic System Controller Essential
    Multifunction Control Display Unit - 1 Essential
    Fuel System Control Panel Essential
    Glareshield Control Panel Essential
    Generator Control Unit - 1 Essential
    Electrical Power Control Unit Essential
    Manifold Failure Control Unit Essential
    Fuel Quantity Standard Electronics Module Essential
    Autobrake Control Unit Essential
    Antiskid Control Unit Essential
    APU Electronic Control Unit Essential
    Fuel Quantity Data Control Unit Essential

    The MD-11 was designed to function in the specified HIRF environments. This design was successfully demonstrated to comply with the FAA/JAA HIRF requirements during certification testing.[24]

    Supplemental Certification of In-Flight
    Entertainment System

    Swissair had installed an IFEN system in their fleet of 16 MD-11 aircraft, and 5 Boeing 747 aircraft beginning in 1996.[25] The IFEN system provided passengers with a touch screen, which could be used to select "on-demand" movies, audio, interactive PC games, a moving map display, advertising, shopping, safety videos, news updates and secure interactive gambling. The system was installed in the first- and business-class sections of the accident aircraft in August/September 1997; the economy-class section of the aircraft was not configured for IFEN system services.

    The installation of the IFEN system into the Swissair MD-11 aircraft was one element of a four-part aircraft interior re-configuration project that Swissair referred to as Product '97. The IFEN system was certified and installed under the authority of the FOCA by their acceptance of the FAA-approved STC, number ST00236LA-D.[26] (STI)

    Environmental conditions and test procedures for airborne equipment are contained in the RTCA/DO-160. EMC testing of the IFEN system LRUs was conducted in accordance with RTCA/DO-160C, sections 16.0, 17.0, 18.0, 19.0, 20.0 and 21.0. Section 20.0 of RTCA/DO-160C specified RF susceptibility tests to determine the performance of the LRUs in the presence of RF voltages coupled into the equipment by a radiated field or by direct conduction into the system by the power input or the interconnect circuit configuration. The IFEN system LRUs were classified as "Category V" equipment and tested to a maximum RF field strength of 50 V/m.[27]

    An EMI ground and flight test[28] was conducted on the IFEN system after it was installed in the MD-11. The purpose of the test was to establish that the IFEN system performed its intended function and did not adversely affect the operation and integrity of other systems on the aircraft, or vice versa. The EMI/RF tests were conducted and, according to the records, no EMI/EMC problems were observed during the testing. However, because the IFEN system was not considered to be a critical or essential system, HIRF testing of the installed IFEN system, in accordance with the original aircraft certification special conditions, was not required and was not performed.

    HIRF Hazard Assessment

    The electromagnetic field strength of an aircraft is primarily influenced by the distance between the aircraft and the emitter and, to a lesser extent, by the EIRP of the emitter. The HIRF hazard is greatest when an aircraft is operating near one or more high-power RF emitters, which may be land-based, ship-borne, or installed on another aircraft. In 1998, the US Navy completed an assessment for the FAA of the peak and average field intensities to which aircraft operating in US civil airspace could be exposed.[29] The assessment considered the minimum separation distances that could exist between civil aircraft and HIRF emitters on surface and airborne platforms, excluding mobile and experimental transmitters, as well as transmitters located inside restricted, prohibited, and danger areas. This information was combined with HIRF data from Western Europe to establish combined FAA/JAA certification guidance regarding the operation of aircraft systems in external HIRF environments. Advisory Circular/Advisory Material Joint 20.1317[30] defines severe, normal, and certification HIRF criteria for 17 discrete frequency bands within the RF spectrum. Canadian certification requirements are similar.

    Table: FAA/JAA HIRF Certification Guidance

    Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003
    Transportation Safety Board of Canada
    Symbol of the Government of Canada

     AVIATION REPORTS - 1998 - A98H0003

    IFEN – Project History and Responsibilities

    1. Background
    2. IFT Marketing of IFEN System to Swissair
    3. Description of the IFT and Swissair IFEN Project
    4. IFT History with IFEN System Installations
    5. Summary of the Arrangement Between IFT, HI and SBA
    6. Statement of Work to the Agreement Between IFT and HI
    7. IFEN Sales and Services Agreement (Swissair and IFT)
    8. FAA Involvement – General Description
    9. Involvement of the Swiss FOCA
      1. FOCA STC Certification Process
      2. FOCA Involvement with the IFT IFEN STC
    10. SR Technics Involvement
    11. STC No. ST00236LA-D – Application and Approval
      1. Background
      2. SBA's Letter of Intent
      3. Excerpts From the SBA LOI
      4. MD-11 Certification Basis
      5. Approval of STC No. ST00236LA-D
    12. STC No. ST00236LA-D Amendments
      1. First Amendment
      2. Second Amendment
      3. Third Amendment
      4. Fourth Amendment
      5. Fifth Amendment
      6. Additional SBA-Approved HI MDL
    13. Location of IFEN Power Supply Circuit Breakers
    14. Electrical Load Analysis
    15. ON/OFF Switch Considerations
    16. Placarding (Labelling) of Circuit Breakers
    17. Weight and Balance
    18. EMI/RF Test
    19. Maintenance Instructions for Continuing Airworthiness
    20. Aircraft Return to Service

    Background

    The installation of the IFEN system into Swissair MD-11 aircraft was one element of a four-part aircraft interior reconfiguration project that Swissair referred to as Product 97.

    The Product 97 initiative to create a new cabin configuration was undertaken in response to perceived market demands for more economy-class seating. Along with numerous changes to the cabin interior and the installation of the IFEN system, this project would reduce the number of first-class seats from 18 to 12, reduce the number of business-class seats from 72 to 49, and increase the number of economy-class seats from 153 to 196, for a total of 257 seats. The overall Product 97 project was the responsibility of SR Technics. The IFEN installation was done by HI under the SR Technics, Swiss FOCA-approved JAR 145 QA program.

    Depending on Swissair's business requirements, the number of passenger seats in the MD-11 aircraft could vary between 239 and 257. At the time of the occurrence, HB-IWF (the occurrence aircraft) was configured with 241 passenger seats.

    IFT Marketing of IFEN System to Swissair

    IFT had expertise in gaming machine technology, and in particular with connecting gaming machines through secure computer networks. IFT was looking to expand and saw an opportunity to use its technology to place highly advanced IFEN systems in commercial airline aircraft.

    IFT initially approached Swissair in 1994 with a proposal to install its IFE system in Swissair aircraft. The Swissair marketing department was enthusiastic about the potential for such a system, as they saw it as an opportunity to set Swissair apart from the competition in the area of customer service. They also saw the system as a generator of revenue, particularly through the gaming aspects of the technology.

    IFT proposed to Swissair that they would install the systems in Swissair aircraft free of charge in exchange for a share of the gaming revenue. In 1994, the initial proposal from IFT was turned down by Swissair when SR Technics assessed the system as insufficiently developed and tested.

    In 1995, IFT approached Swissair with a similar proposal. Again, the proposal was rejected, primarily because of SR Technics' concerns about the power requirements and weight of the system.

    The marketing department at Swissair persuaded Swissair management to reconsider the option of installing IFE systems in Swissair aircraft. Integral to that decision was the fact that, by early 1996, IFT had installed its IFEN system on four MD-11 aircraft of another carrier. Subsequently, Swissair decided to issue a request for proposals, to which there were eight responses. Eventually, IFT was chosen, as they met the technical specifications and were judged to have offered a superior financial package (including free installation, and gaming revenue potential). The IFT system was also viewed as being the most "mature," in particular because the associated hardware was already developed and available.

    Description of the IFT and Swissair IFEN Project

    In May 1996, IFT and Swissair signed a letter of intent to have the IFT IFEN system installed in Swissair's 16 MD-11s and 5 B-747s. The first MD-11 installation was to take place in October 1996.[1]

    In the agreement with Swissair, IFT was responsible for the integration of a new generation of its IFEN system into the Swissair aircraft. IFT responsibilities would include all aspects of the installation, including the system design, certification, the actual installation, ongoing support, training, and the continuing airworthiness of the system.

    The Swissair-IFT plan for the MD-11 was to configure the IFEN system to allow passengers, including those in economy class, to access the system. Passengers were to be able to select, by touching the screen, on-demand movies, audio, interactive games, a moving map display, advertising, shopping, safety videos, news updates, and secure interactive gaming. These services were to be made available in five languages, and the menu was to be available in seven languages.

    By April of 1997, with only four MD-11 aircraft in revenue service equipped with IFEN systems, it was apparent that the expected revenues were not forthcoming. For business reasons, IFT and Swissair decided to reduce the IFEN system configuration to accommodate only first- and business-class passengers. The original contract was changed in October of 1997. Only two MD-11 aircraft had the full 257-seat IFEN system installed. In the accident aircraft, the IFEN system was installed in 61 seats, in the first- and business-class seats only.

    IFT History with IFEN System Installations

    IFT's specialty was the design and manufacture of the IFE system components. The company had started in this field in 1994, and had sold a first-generation version of their IFE system to an airline for installation on four MD-11 aircraft.

    For IFT to enter into any contract that would include more than the design and manufacture of the IFEN system, IFT would have to subcontract additional expertise. For example, for the contract with their first customer, IFT had contracted Elsinore Aerospace to do the design, certification and installation work. (Elsinore was eventually purchased by HI's parent company, and employees from Elsinore were subsequently employed at both HI and SBA.)

    Summary of the Arrangement Between IFT, HI and SBA

    IFT did not have, from within the company, all of the expertise required to fulfill its Swissair IFEN system contract requirements. Therefore, IFT required the services of others who had expertise in integrating an IFE system into an aircraft design, certifying the system, and installing the system into the aircraft.

    In July 1996, IFT entered into an agreement with HI, an FAA-certificated repair station, for the IFEN system design, integration, and installation functions. This included the development of all necessary engineering drawings and documents, and the manufacturing of wire bundles, equipment racks, and structural supports necessary for the installation of the IFEN system. Under the terms of the contract, HI was also responsible for the installation of the system into each aircraft (to be done at the SR Technics facilities in Zurich).

    Only the FAA or a DAS can certify an STC (an STC is required for an IFE system). HI entered into an agreement with SBA to provide the certification services. Under the agreement between HI and SBA, SBA became responsible for the certification of the IFEN system, and for issuing the STC. SBA became the applicant and, therefore, in the eyes of the FAA, the owner of STC ST00236LA-D, and as such was responsible for the continuing airworthiness of the STC.

    According to a separate contractual arrangement between IFT and SBA, although SBA remained the owner of the STC, IFT was given an exclusive license agreement for the rights to the STC in perpetuity. SBA provided experienced specialists, including DAS inspectors, who had the authority to work in areas such as electrical, avionics, structures, interior and crashworthiness, and flammability. Additionally, IFT contracted with SBA to review and approve test plans and results in support of environmental testing of the IFEN system components.

    Statement of Work to the Agreement
    Between IFT and HI

    In order to satisfy their obligations to Swissair, IFT entered into an agreement with HI. Details of the required work were contained in a statement of work, which formed part of the formal agreement. Of interest to the SR 111 investigation was the section that dealt with cabling interfaces to the aircraft power:

    3.1.8 Aircraft Power and Existing System Interface—System cabling interfaces to aircraft power and existing aircraft systems will be defined by the airline customer and will be communicated to HI.

    Both IFT and HI indicated that they expected that Swissair would provide this information. However, the detailed specification produced by Swissair and appended to the Sales and Services Agreement did not include any reference regarding how the IFEN system was to be integrated into the MD-11 electrical system. Although certain technical information was requested by IFT and HI from Swissair, there is no record of a specific request relating to system cabling interfaces to aircraft power.

    Among the documents received by the TSB from Swissair was an unsigned statement of work between HI and IFT. It appears that this was an early version of the final statement of work, which would later form part of the formal agreement between HI and IFT dated 30 July 1996. According to fax markings, the early version was faxed from HI on 24 May 1996 to an unknown recipient. Regardless, both versions of the statement of work contained the statement in Section 3.1.8 quoted above.

    IFEN Sales and Services Agreement
    (Swissair and IFT)

    Paragraph 4.2.1 of the Sales and Services Agreement, dated 22 October 1996, contains the following statements under Section 4.2. (Installation), 4.2.1 (Responsibility: Anticipated Schedule):

    …with the reasonable cooperation of Swissair, IFT shall be responsible for installation of the IFEN-2 Basic Shipsets….

    …subject to timely approval by Swissair of the Specifications and acceptance by Swissair of the final IFEN-2 Basic Shipset design….

    IFT was responsible for the installation of the IFEN system, but considered SR Technics, on behalf of Swissair, to be an active partner in the approval and acceptance of the IFEN system. IFT believed that the basic shipset design approval included both the design of the system and its integration into the aircraft.

    Conversely, Swissair considered their approval of the final IFEN-2 basic shipset design to consist of ensuring that IFT's modification of IFT's existing IFEN-2 system design had been done in accordance with the Detailed-Specification as drafted by SR Technics.

    FAA Involvement – General Description

    The FAA was involved in the IFT IFEN system installation project in two ways:

    • the FAA was responsible for authorizing SBA as a 14 CFR Part 21 DAS, and for the ongoing regulatory oversight of SBA; and
    • the FAA was directly responsible for reviewing, assessing, and accepting the SBA LOI for this installation.

    Involvement of the Swiss FOCA

    FOCA STC Certification Process

    The FOCA certification process allows for two methods for STC certification: a Swiss STC can be approved by the FOCA under JAR 21, or an FAA-approved STC can be accepted by the FOCA.

    FOCA Involvement with the IFT IFEN STC

    Before contracting with IFT, Swissair advised the FOCA that they were planning to use an FAA-approved STC to install the IFT IFEN system in their aircraft. Swissair was informed by the FOCA that in lieu of a formal Swiss STC, the installation would be allowed if it was based on an FAA-approved STC and was done in accordance with applicable regulatory requirements.

    The actual IFEN system installation work was to be performed on Swissair aircraft at SR Technics facilities in Zurich, Switzerland, under the provisions of JAR 145. As per the terms of the contractual agreement between Swissair and IFT, the installation work was to be completed by IFT or its third-party subcontractors. In this case, IFT subcontracted HI to perform the installation work. The FOCA informed HI that their personnel were authorized to perform the IFEN system installation work only if it was accomplished under the SR Technics QA program, and in accordance with JAA Leaflet 3.[2] Accordingly, HI was required to submit FAA Form 337 to SR Technics, documenting that the system was installed in accordance with the certification requirements of STC ST00236LA-D.[3] Although FAA Form 337 was not typically used in Switzerland, this method was acceptable to the FOCA.

    The FOCA accepted the FAA STC ST00236LA-D and did not perform any formal validation of the IFEN system. The FOCA did not assume any direct oversight responsibility for the IFT IFEN installations into the Swissair aircraft.

    A FOCA memo entitled "MD-11 Product 97 Fact Sheet," dated 10 November 1998, records the results of FOCA inspections conducted on Swissair's MD-11 Product 97 installations. This memo states that the "FOCA discovered important deficiencies . . . ." While the IFEN system is listed as one of the installations inspected, no deficiencies were noted relating to the IFEN installation.

    SR Technics Involvement

    In their capacity as a JAR/FAR 145 maintenance facility, SR Technics was the engineering authority for Swissair's fleet of MD-11 aircraft. In that capacity, they were responsible for the continuing airworthiness of these aircraft.

    As part of the IFEN system Sales and Services Agreement between IFT and Swissair, SR Technics produced a document called Detail—IFEN Specification for the Interactive Inflight Entertainment & Cabin Management System (IFE) on Swissair's MD-11 and B-747, dated 22 July 1996. This specification was described by SR Technics as "the Specification for an interactive video/audio/cabin management system, manufactured by Interactive Flight Technologies Inc., (IFT), Type IFEN-2 for all our MD-11 and B-747 aircraft." SR Technics considered the intent of this document as being to provide IFT with "functional specifications" as to how the IFEN system was to perform in Swissair's MD-11 aircraft.

    In order to provide Swissair with a level of confidence regarding the IFEN system installation project, and to comply with the FOCA-imposed conditions requiring the use of the SR Technics QA program for the use of STC ST00236LA-D, SR Technics agreed with Swissair marketing to

    1. participate in the commercial negotiations;
    2. work out the specifications required;
    3. provide detailed information on technical questions;
    4. provide documentation;
    5. provide project management meetings;
    6. coordinate the project work within SR Technics and with IFT;
    7. coordinate the work with Hollingsead;
    8. assist the modification crew;
    9. allow its infrastructure to be used for installation purposes; and
    10. provide QA by continuously monitoring HI's work to ensure it met regulations and standards set by the CAAs, the aircraft producers, and Swissair.

    This agreement, known as the September 1996 Offer, described the scope of these duties, which included monitoring the quality of the work, defining specifications, and providing detailed information on technical questions.

    IFT became a signatory to the agreement (September 1996 Offer) on 10 October 1996. IFT considered this to be a three-party agreement under which SR Technics oversight of HI's installation was also being done on behalf of IFT. IFT indicated that it was paying SR Technics for this service.

    All IFEN installations were to be accomplished during regularly scheduled heavy maintenance or "D checks." SR Technics received a completed FAA Form 337 from HI after each installation. SR Technics used the FAA Form 337 to confirm that the IFEN system installation had been done in accordance with the FAA-approved STC and the FAR, Part 43. The FAA Form 337 was part of the supporting documentation used to return the aircraft to service.

    STC No. ST00236LA-D – Application and Approval

    Background

    The modification of Swissair's fleet of MD-11s was accomplished through the STC process using SBA as the certifying agent under its authority as a DAS. In its capacity as a DAS, SBA was contracted by HI to perform the required certification services on behalf of the FAA. In particular, HI contracted SBA to provide the necessary certification services, such as approving data to show compliance with applicable regulations, test witnessing, drawing review, and parts and installation conformity. IFT also contracted SBA to review and approve test plans and results in support of environmental testing of IFE components. SBA did not perform any design or installation functions in support of the project. According to the LOI, SBA was the applicant and owner of the STC. However, according to the contractual arrangement between IFT and SBA, although SBA remained the owner of the STC, IFT was given an exclusive licence agreement for the rights to the STC in perpetuity. SBA was responsible for the continuing airworthiness of the STC.

    Components such as wire bundles, equipment racks, and structural supports necessary for the installation of the IFEN system were manufactured by HI in Santa Fe Springs, California, while IFT manufactured the LRUs in Phoenix, Arizona. SBA, under its authority as a DAS, authorized HI and IFT to obtain statements of conformity for these components. SBA's DAS manual, Section 2.3 (f) allows "SBA to authorize, in writing a qualified representative of that facility or supplier to act as SBAs agent and execute an FAA Form 8130.9, Statement of Conformity."

    According to the SBA DAS manual, Section 2.1 "Defining the Project," a DAS will initiate an STC project by submitting an LOI to the ACO along with the FAA STC application Form 8110-12. The SBA LOI and Form 8110-12 were forwarded to the LAACO on 19 August 1996 (SBA Document C-DAS14NM-1, Appendix 1). The LOI is required by FAA Order 8110.4A (and the DAS manual) to include a complete description of the system operation and installation, to complement the data that will show compliance. The SBA LOI contained the following information:

    • General intent to certify an IFT entertainment system;
    • Modification description;
    • Interaction of the entertainment system with aircraft systems;
    • Conformity and compliance inspection;
    • List of DAS staff;
    • Applicable certification basis and compliance checklist;
    • Experimental airworthiness certificate requirements (if any); and
    • Project schedule.

    SBA's Letter of Intent

    The LAACO received the SBA LOI, DAS Project DAS14NM97, and stamped it as "received" on 23 August 1996. The LAACO review of an LOI is performed in accordance with FAA Order 8110.4A by a team that typically consists of an aviation safety specialist, an airframe aerospace engineer, a system and equipment aerospace engineer, a propulsion aerospace engineer, a flight test pilot, a MIDO aviation safety inspector, and an AEG specialist. Accordingly, the SBA LOI documentation was circulated to the appropriate branches of the LAACO as well as the MIDO and AEG offices. LAACO records indicated that the propulsion and flight test branches, and the MIDO, did not sign the "coordination" sign-off stamp.

    The FAA review of the LOI resulted in two additional requests of compliance, one with respect to the delethalization requirements of FAR 25.785, and one for the interior material flammability requirements of FAR 25.853. These two further requirements were handwritten on the front page of the LOI as follows: "Perform bowling ball test for existing and new food tray configurations" and "Flammability by test, and substantiation." The assigned FAA project manager reportedly contacted SBA by phone and advised SBA of the additional requirements. SBA submitted an amended LOI on 3 October 1996 incorporating the additional test requirements, added a flammability DAS specialist to the list of DAS staff, and amended the Certification checklist to include FAR 25.869(a), concerning fire protection systems. The FAA accepted the SBA LOI on 8 October 1996 and faxed the top sheet of the initial LOI with the handwritten FAA comments with "FAA Accepted" stamped on the document to confirm their acceptance.

    Excerpts From the SBA LOI

    In the original LOI, at Section 2.6.1.1, SBA had attempted to meet the requirement for head-strike testing by stating:

    Head strike testing of the seat with tray/display stowed will be conducted in accordance with FAA Advisory material AND FAR 25.562 (HIC).

    Although this statement was typical for air telephone installations in seat backs, it was not acceptable to the FAA LAACO for this project. The FAA requested an additional "bowling ball" head injury impact test. To comply with the additional FAA LAACO requests, SBA amended the LOI by adding the following to Section 2.6.1.1:

    The head strike tests will be conducted with the unmodified tray and the modified tray.

    Under the Modification Description, Section 2.8 of the LOI stated the following:

    there are no changes to the Pilot or Copilot's panels.

    Under Aircraft Systems/Entertainment Interaction, Section 3.1 of the LOI stated the following:

    the system to be installed is a "non-essential, non-required" passenger entertainment system. There is no single failure or latent multiple failure which would affect the ability of the aircraft to continue safe flight and landing, significantly increase flight crew work load, or require unusual strength.

    The extent to which the LOI addressed the STC's impact on the operational characteristics of the MD-11 was stated in sections 2.8 and 3.1.

    Section 6 of the LOI, "Certification Basis and Compliance Checklist," stated the following:

    As specified in type certificate sheet A22WE for McDonnell Douglas MD-11 aircraft plus the attached compliance checklist applicable to the telephone installation to amendments effective August 19, 1996, date of application of this STC.

    This statement was incorrect, as it described a telephone installation instead of an IFEN system installation and was never noted or corrected by either SBA or the FAA.

    Also in Section 6 of the LOI, SBA outlined the electrical compliance checklist for the project, which included FAR 25.1309 (Equipment, Systems and Installations), sub-parts b, e, f, and g. Under the means of compliance, SBA indicated that sub-parts b, e, and f would be accomplished by analysis; sub-part g was left blank. Section 8 of the LOI detailed the schedule for the various activities as follows:

    Frequency Field Strength (V/m)
      Severe HIRF fixed-wing aircraft Normal HIRF on approach and landing Certification HIRF
    Peak Average Peak Average Peak Average
    10–100 kHz 50 50 20 20 50 50
    100–500 kHz 60 60 20 20 50 50
    500 kHz–2 MHz 70 70 30 30 50 50
    2–30 MHz 200 200 100 100 100 100
    30–70 MHz 30 30 10 10 50 50
    70–100 MHz 30 30 10 10 50 50
    100–200 MHz 90 30 30 10 100 100
    200–400 MHz 70 70 10 10 100 100
    400–700 MHz 730 80 700 40 700 50
    700–1000 MHz 1 400 240 700 40 700 100
    1–2 GHz 3 300 160 1 300 160 2 000 200
    2–4 GHz 4 500 490 3 000 120 3 000 200
    4–6 GHz 7 200 300 3 000 160 3 000 200
    6–8 GHz 1 100 170 400 170 1 000 200
    8–12 GHz
    Letter of intent and STC Application 8/19/96
    Drawings Complete 9/04/96
    Part Conformity (start) 8/21/96
    Installation conformity 10/29/96
    EMI Ground and Flight Test 10/29/96
    Compliance Inspection Walk through 10/29/96
    Issue STC 10/29/96

    MD-11 Certification Basis

    The MD-11 Type Certificate A22WE defines the certification basis of the aircraft and the regulations to which STCs must comply. The MD-11 was certified in compliance with Part 25 of the FARs by amendments 25-1 through 25-61, except for sections 25.607, 25.631(65), and 25.1309(66) as amended by Amendment 25-22; Section 25.109 as amended by Amendment 25-41; and sections 25.832(67) and 25.858. The MD-11 Type Certificate Note 66 indicated specifically that any "new systems and systems with major changes will comply with Amendment 25-61."

    Along with the above type certificate requirements, the basis of certification as established by SBA in the LOI lists all the applicable FARs with which the IFEN system must comply, the means of compliance, and the applicable references.

    Approval of STC No. ST00236LA-D

    On 19 November 1996, STC ST00236LA-D was approved by SBA and issued as a "Provisions only installation of Interactive Flight Technologies Inc. Entertainment System per Hollingsead International Master Data List (MDL) 12003-511, Revision C." This installation was limited to aircraft SN 48445 (HB-IWC) only. The approved MDL contained six notes. Note 2 stated: "The maintenance instructions for continued airworthiness shall be reviewed by the FAA Flight Standards Aircraft Evaluation Group and are contained in Hollingsead International Document No. TBD." This document, 20091, was not identified until the fifth amendment. The maintenance instructions were a work-in-progress at that time and were eventually released in March 1997, two months after the issuance of the first operational IFEN STC installation approval. Note 6 stated:

    The installation of the entertainment system defined herein requires that the aircraft interior be configured in accordance with FAA-Approved Swissair Layout of Passenger Accommodation (LOPA) 991056 (257 PAX) or 991057 (243 PAX) per STC (TBD).

    The installation of the IFEN system was being accomplished during a regularly scheduled "D check," where the IFE STC was one of four STCs being incorporated into the aircraft. Swissair referred to the whole project as Product 97. According to the Product 97 modification, the cabin configuration of the MD-11 fleet had to be changed into two flexible configurations.

    As a "Provisions Only" installation, the MDL approved by SBA on 19 November 1996 did not include any LRUs, as they were not yet available, and this resulted in only a partial installation of wiring and mounting hardware in HB-IWC. This first partial installation did include SBA-approved HI drawings 90049-511, "Overhead System Cable Routing Installation Kit Rev. A," dated 11 November 1996, and 90010-501, "System Circuit Breaker Installation Kit Rev. A," dated 14 November 1996. These drawings confirmed that four of the six PSU CBs were to be mounted in the lower avionics CB panel (also referred to as the observer's panel) located in the cockpit. The installation of CBs in the cockpit changed the scope of the project, in that the cockpit environment was altered. There is no indication that HI considered the operational impact of this change. SBA did not notify the LAACO to obtain its determination as to the significance of this change, nor did SBA submit an amended LOI.

    The STC certificate incorrectly lists the Original Product – Type Certification Number as A22E and not A22WE for the MD-11. The STC date of application is shown as 9 August 1996, when the actual date on the application, FAA Form 8110-2, was 19 August 1996.

    At the time the STC was issued on 19 November 1996, the following engineering drawings were not complete, and were dated "TBD."

    • Systems Electrical Load Analysis (Document 20032)
    • Systems Acceptance Test Procedure/Report (Document 20033)
    • EMI/RF Test Plan/Report, Ground and Flight (Document 20034)
    • Weight and Balance Report (Document 20035)
    • System Flammability Test Plan/Report (Document 20047)

    Although MDL Document 20035 (Weight and Balance) was indicated as TBD, an FAA Form 337 had been completed by HI that indicated the weight and balance was "accomplished by actual weighing of the aircraft and is included in HI Weight and Balance Report No. 20035." This form also indicated that the system was deactivated.

    Two "Statement of Compliance with the FAA Regulations" forms were provided by SBA and both were dated 19 November 1996. One statement identifies the approved data for seven of the documents referenced in the MDL 12003-511 (page 3 of 4), along with the "Structural Substantiation for Equipment Rack Installation for MD-11," Document ER134-1001. The structural substantiation was performed by Total Aircraft Services, Inc. of Chatsworth, California. This Statement of Compliance does not reference a particular configuration and, except for the date, it would not be possible to reference it to any particular configuration. Furthermore, two of the documents referenced in this statement of compliance, 90044-512 and 90046-512, have revision numbers different from those referenced in the MDL. Also, this particular document was not signed by the DAS Coordinator. The second statement of compliance does reference configuration 12003-511 Rev C and was signed by the DAS Coordinator.

    STC No. ST00236LA-D Amendments

    First Amendment

    On 18 December 1996 the STC was amended to add provisions for another IFEN configuration as defined by HI MDL 12003-521 Rev C1, dated 17 December 1996. Under the Limitations and Conditions section of the STC, MDL 12003-511 Rev C was applicable to aircraft SN 48445 (HB-IWC) only, and this latest MDL 12003-521 Rev C1 was applicable to aircraft SN 48446 (HB-IWD) only. At this point, the two IFEN system configurations were applicable to two aircraft. In this amendment, in the Original Product – Type Certification Number section, the correct type certificate number was referenced as A22WE.

    This first amendment also referenced the System ELA Document 20032 Rev N/C (initial release drawings). HI provided three versions of Document 20032 Rev N/C. One version was referenced by HI as an early development version that was not approved and not dated. A second version of 20032 N/C was stamped as "PRE RELEASE" and dated 16 January 1997, but it too was not approved or released. The third version of 20032 Rev N/C was dated 18 January 1997 and stamped "History Print for Reference Only." The latter two versions were dated after the first amendment was approved by SBA and, therefore, could not be the referenced documents. According to HI, the ELA for this first amendment should have read TBD, as it did for the issuance of the STC. There was no approved ELA N/C, and the change in this MDL to reflect this was a mistake. However, at that time no loads were physically attached to electrical buses in the aircraft.

    Second Amendment

    On 24 January 1997, the STC was amended a second time, adding a new configuration according to HI MDL 12003-501 Rev D for 257 passengers. This configuration replaced both previous configurations: 12003-511 and 12003-521. At this point, the system was missing the left and right front row monitors in economy class and the first-class IFEN-equipped seats, as they were not available. The Limitations and Conditions section of the STC notes that the STC was applicable to SNs 48445, 48446, and 48452 only (HB-IWF was SN 48448). It also indicates:

    [t]he installation of passenger seats and all other aspects of cabin interior arrangement are NOT approved by this STC, and must be approved separately. A copy of this STC must be included in the permanent records of the modified aircraft. All of the above interior furnishings have been demonstrated to meet the flammability requirements of FAR 25.853(B) (Amendment 25-32) and 25.1359(d) (Amendment 25-32).

    This latter statement placed the burden on the seat manufacturers to ensure that the seat-mounted components were in compliance with the applicable certification requirements. ELA 20032 Rev N/C, was revised to 20032 Rev A, which is the first approved and released ELA.

    Third Amendment

    The STC was amended a third time, on 3 February 1997, approving the same configuration as the second amendment, namely HI MDL 12003-501 Rev D. However, under the Limitations and Conditions section the specific MD-11 SN applicability was removed, resulting in the approval of the STC, configuration 12003-501 for 257 passengers, on all of Swissair's fleet of MD-11s.

    Fourth Amendment

    The STC was amended a fourth time, on 11 March 1997, to add the words "or Subsequent FAA Approved Revisions" to the "Description of the Type Design Change". According to the FAA, this is a normal statement to include on an STC, and should have been accomplished at the third amendment level. The additional words allow the STC holder to obtain approval for minor design changes without having to amend the STC document each time a design change is FAA-approved.

    Fifth Amendment

    The STC was amended a fifth time, on 7 August 1997, to approve a second IFEN configuration, 12003-503 Rev A, dated 28 July 1997, for 243 passengers. At this point, the STC approved two IFEN configurations: the -501 Rev D for 257 passengers and the -503 Rev A for 243 passengers, in accordance with FAA-approved Swissair LOPAs 991056 and 991057, respectively.

    The ELA was also revised in the fifth amendment from 20032 Rev A to Rev B. ELA Rev B references two electrical summaries, one for 257 passengers and the other for 239 passengers. There is an apparent discrepancy between the referenced configuration, -503 for 243 passengers, and the ELA Rev B that references 257 and 239 passengers. There was no mention of an ELA for a 243-passenger configuration. According to HI, this was another mistake, in that ELA Rev B was not approved at that time, and was a work-in-progress. It should not have been referenced in this amendment to the STC. Also, released at this time was Drawing 20092, "Maintenance Instructions for Continued Airworthiness", dated 20 March 1997.

    Additional SBA-Approved HI MDL

    On 22 October 1997, SBA approved another version of MDL 12003-503, revising the previous configuration, Rev A, to Rev B. The MDL can be revised without amending the STC, as previously stated, when the STC reads, "or Subsequent FAA Approved data." The MDL dated 22 October 1997 is DAS FAA-approved data. This revision added a provisions kit for first-class seats. The IFEN first-class seats became available on 10 October 1997. According to SBA, a second EMI/RF test plan, ground and flight, was conducted on 22 October 1997 when the IFEN- equipped first-class seats were first installed. However, the investigation could find no substantiating data to show that this test plan was conducted.

    For the occurrence aircraft, the installation of the IFEN system was accomplished during a "D check" between 21 August and 9 September 1997, under MDL 12003-501 Rev D for 257 passengers. At this time, the IFEN-equipped first-class seats were not available. They were subsequently installed on 20 to 21 February 1998, when the first- and business-class sections of HB-IWF were re-configured as part of the Product 99 modification. HI provided an FAA Form 337, dated 21 February 1998, stating the work had been accomplished in accordance with HI MDL 12007. However, MDL 12007 is shown to be applicable to Boeing 747-300 aircraft only.

    According to HI, MDL 12003-501 was revised to Rev E on 16 September 1997 and to Rev F on 8 January 1999. Both of these revisions reference 239 passengers. This change was based on the Swissair FAA-approved LOPA 991064 for 239 passengers. Although the IFEN system was now being installed in only 61 seats (first and business classes), ELA 20032 Rev A was not updated to reflect this change. The investigation revealed no SBA DAS-approved copies for these latest two changes to the MDL. Although the number of IFEN-equipped seats was substantially reduced, the documentation provided by HI that reflected these changes was not forwarded to, or approved by, the DAS.

    For the accident aircraft, on 14 August 1998, SR Technics added two more seats to economy class, under EO 511648. The two seats were reserved for aircraft crew, bringing the HB-IWF seat count to 241. At this time, only the 12 first-class and 49 business-class seats were IFEN-equipped.

    Location of IFEN Power Supply Circuit Breakers

    The LOI described a system that would have no impact on the cockpit environment. A review of the HI ELA 20032 Rev A, approved by SBA on 24 January 1997, states on page 4, paragraph 2, that "the PSU (Power Supply Unit) inputs are protected by 3 phase, 15 Amp breakers located in the Cockpit Observers Station and LH Mid Circuit Breaker Panels." Furthermore, paragraph 4 states that "A 1 Amp, 28 V DC circuit breaker, located on the upper panel [upper panel refers to the avionics CB panel] of the cockpit observer's station provides power to the entertainment system Relay Box which is located above the G-8 Galley." Also, HI 90010 "System Circuit Breaker Installation Kit," issued in November 1996, stated that the 8 AWG main power supply cable was connected to the S3-600 terminal strip in the avionics compartment and routed to the cockpit lower avionics CB panel. The ELA and IFEN system installation drawings approved by SBA were in disagreement with the LOI.

    Electrical Load Analysis

    Prompted by the disagreement between the LOI and ELA 20032 Rev A over the CB locations, the various ELAs produced in support of Rev A were reviewed during the investigation. It is noted that the original Swissair MD-11 ELA was not available to HI until August 1996, when HI produced the fifth amendment of the IFEN-related ELA. During the investigation, HI provided an early development version of ELA 20032 Rev N/C, dated 28 August 1996. This version was neither released nor signed by HI. This early version did not mention the location of the IFEN CBs. However, of interest in this version were the following statements:

    Each power supply, 200 V AC, 400 Hz 3 phase power input is fed from the AC Cabin Bus distribution system. The AC Cabin Bus distribution system is manually s Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003

    Transportation Safety Board of Canada
    Symbol of the Government of Canada

     AVIATION REPORTS - 1998 - A98H0003

    IFEN – Installation

    1. IFEN Installation
    2. Technical Documentation Requirements
      1. HI Drawings
    3. SR Technics QA
    4. CB Installation
      1. Lower Avionics CB Panel
        1. CB Unit 1
        2. CB Unit 2
      2. Left-Hand Mid-equipment Panel
    5. IFEN Wiring
      1. Contract Specifications
      2. FAR 25.1353 Specification
      3. Military Specifications for Wire
      4. McDonnell Douglas Wiring Guidelines
      5. Power Cable Design Specifications
    6. IFEN Installation Observations
      1. Installation of the Main Power Cable and PSU CBs – Lower Avionics CB Panel
        1. Discrepancies
      2. Installation of the 8 AWG Jumper Wires – Lower Avionics CB Panel
        1. Discrepancies
      3. Installation of the PSU Cable – CBs to E-Rack 1
        1. Discrepancies
      4. Installation of the PSU Cable – CBs to E-Rack 2
        1. Discrepancies
      5. Installation of the Main Power Cable – Left-Hand Mid-equipment Panel
        1. Discrepancies
      6. Installation of the 8 AWG Jumper Wires – Left-Hand Mid-equipment Panel
        1. Discrepancies
      7. Installation of the "IFT/VES 28V" 1 A CB and Wiring
        1. Discrepancies
      8. Wiring Installation – SDU to Galley 1 MTEB
        1. Discrepancies
      9. HI EO Observations
    7. STC Inspection Requirement
      1. Conformity Inspection
      2. Compliance Inspection
      3. SBA Conformity/Compliance Inspections

    IFEN Installation

    All IFEN installation work was accomplished by HI personnel at SR Technics' facilities in Zurich, Switzerland. HI personnel responsible for the installation included an on-site supervisor, a chief inspector, and three working groups. The structures group was responsible for installing the E-racks and other structural items, the cabin group was responsible for installing the cabling, and the electrical group was responsible for assisting with technical problems during the modification and system testing. It was HI's practice to employ contract employees to perform the majority of the installation work and to assign permanent employees to provide QA oversight. HI has indicated that, for the most part, the installation team comprised the same personnel for all of the installations.

    The IFEN installation was carried out under HI EO 20016-501 Rev B Interactive Flight Technologies Inc. Entertainment System on Swissair MD-11 Aircraft. This EO was applicable to the occurrence aircraft and provided instructions for the provisioning and modification of the aircraft structure, electrical systems, and interior components required to install the IFT IFEN system. This EO also identified reference materials including the HI installation kit drawings and the MD-11 MM, SRM, WDM, and the IPC. The EO did not identify the applicable revision status of the HI kit drawings or of the supporting documents.

    The TSB reviewed HI drawings and various supporting documents pertaining to the installation of the IFEN system cabling and to the design and manufacture of the various power cable assemblies.

    MDL 12003-501 (257 Pax) Rev D, dated 24 January 1997, was applicable to HB-IWF at the time of the IFEN system installation. This MDL referenced the following drawings and documents:

    • 20023 Rev N/C (04-18-97) Wiring Drawing (drawing marked "for reference only")
    • 20017 Rev N/C (01-21-97) System Functional Block Diagram
    • 90010 Rev B1 (01-22-97) System Circuit Breaker Installation Kit
    • 90049 Rev C2 (02-05-97) Overhead System Cable Routing Installation Kit
    • 20016 Rev N/C (01-20-97) Engineering Order/Installation Procedure
    • 20032 Rev A (01-21-97) System Electrical Load Analysis

    By the time the IFEN system was installed in HB-IWF these drawings had been revised as follows:

    • 20023 Rev B (06-05-97)
    • 20017 Rev B (04-10-97)
    • 90010 Rev B (12-30-96)
    • 90049 Rev D (05-06-97)
    • 20016 Rev B (08-20-97)

    It was HI's practice to use the most recent version of drawings for system installations, including the IFEN installation.

    Although they were not included in the MDL, the following drawings were identified in the ELA as applicable documents for the ELA for the Swissair MD-11. The TSB determined the drawings to be pertinent to defining the IFEN system configuration.

    • 20042 Rev C (12-31-96) Schematic Circuit Breaker Unit #1
    • 20045 Rev A (12-31-96) Circuit Breaker Unit #2 Schematic

    During the IFEN system installation documentation review, (STI) the TSB identified numerous discrepancies in the approved drawings and supporting documentation. SR Technics indicated that they had previously experienced difficulties troubleshooting the IFEN system because the HI wiring diagrams did not always represent the actual installation.

    Many discrepancies were noted when the HI wiring diagrams were compared to the IFEN MM. IFT had obtained HI engineering information, including wiring diagrams, to develop the IFEN MM. It was IFT's responsibility to ensure that HI technical documents were consistent with IFT's specifications and documentation.

    Technical Documentation Requirements

    The agreement between IFT and HI, entered into on 30 July 1996, outlined the following requirements for technical documentation with which HI was required to comply:

    • Ensure the accuracy and consistency of HI technical documentation with the applicable IFT or Swissair source specifications, documents, and drawings.
    • Prepare an installation block diagram illustrating basic LRU to LRU system connections.
    • Prepare all structural, cabling, and equipment installation drawings.
    • Prepare a detailed installation work-scope, based on HI installation drawings and test documents, that provides written installation instructions sufficient to install all parts manufactured or purchased by HI and all equipment supplied by IFT. The work-scope must contain test plans to verify that the IFT IFEN system does not interfere with the existing aircraft systems.
    • Prepare a system wiring diagram illustrating the entire system wiring definition, equipment pin assignments, grounds, and so on. This drawing must specify aircraft effectivity by assigned aircraft registration numbers.
    • Prepare a system schematic diagram, showing the entire system connectivity and LRU internal functionality. This drawing must specify aircraft effectivity by assigned aircraft registration numbers.
    • Prepare a master drawing and a data list of all IFT and HI drawings and documents that affect the configuration and certification of the existing Swissair aircraft.
    • Prepare all mechanical and cabling assembly and detail drawings.
    • Create task cards for all installation activities including aircraft specifics, such as tail number, type, and so on.

    HI produced task cards that provided installation information. These cards were to be used in conjunction with the STC EO. A tally sheet listing all of the task cards was used as a tracking device and a master sign-off sheet for the task cards. Once all of the task cards were completed and accounted for, HI signed off the EO and issued an FAA Form 337 to SR Technics. Each task card identified the aircraft type and registration information.

    HI Drawings

    The Statement of Work contained in the agreement between IFT and HI outlined the requirements for structural, cabling, and equipment installation drawings. IFT required HI to provide and prepare all structural, cabling, and equipment installation drawings as CAD electronic files using AutoCAD® 12.0, or a later version. Additionally, IFT required HI to provide the installation drawings in both electronic and paper formats.

    HI's approved procedures required each drawing to undergo the following quality control review process prior to being approved and released for use:

    • The CAD operator ensures that the drawing accurately and correctly reflects the design information.
    • An independent reviewer assesses the drawing to ensure that it complies with HI's published drawing practices and to verify that the information is correct.
    • An engineer assesses the drawing.
    • The project engineer assesses the drawing.

    The approval box on the first page of the drawing requires that each of these steps be signed off, including the name of each signatory and the date. These four approval boxes on the HI drawings reviewed by the TSB had been signed off and dated.

    Standard CAD drawing practices allow a CAD operator to simply "cut/copy and paste" information between drawings and most other documents produced in electronic format, thereby minimizing the potential for errors when transferring information. This practice enables information to be copied from one drawing to sub-assembly drawings, installation drawings, IFEN MM figures, WDM supplements, and installation instructions.

    SR Technics QA

    The agreement between Swissair and SR Technics, dated September 1996, required SR Technics' QA department to inspect the installation work accomplished by HI. (STI) SR Technics performed detailed QA inspections on the first three aircraft to assess HI's work. As SR Technics became more confident in the quality of HI's work, the company relied on their normal "D check" QA procedures.

    CB Installation

    The HI system design specified the use of jumper wires between CBs as a means of supplying power to each adjacent CB.

    CB identifications and ratings, as described below, are based on information obtained from HI drawings applicable to the MD-11 IFEN system installation.

    Lower Avionics CB Panel

    Each of the four installed PSUs were powered by a three-phase CB located on the lower avionics CB panel, grouped under the heading "IFE/VES, 115 VOLTS AC POWER (3ø)."

    The "IFT/VES 28V" 1 A CB was located on the lower avionics panel, grouped under the heading "DC BUS." This CB provided 28 V DC power to the IFEN system relay assembly located above Galley 8. Removal or loss of this 28 V DC power caused an "On/Off" relay, located within the relay assembly, to supply a ground that disabled the output of the PSUs.

    The IFEN CB placards on the lower avionics CB panel did not conform with the aircraft manufacturer's standard for CBs. According to the standard, the electrical bus (1, 2, or 3) that was the originating source of power was to be identified on the placard. The IFEN system placards did not identify the electrical bus that provided the power for the PSUs.

    Table: CB Installation

    CB Identification Rating (A) CB Power Source CB Panel Location
    RACK1 PS1 15 Terminal Strip S3-600 (115 V AC Bus 2) F7
    RACK1 PS2 15 RACK1 PS1 CB F9
    RACK2 PS3 15 RACK1 PS2 CB F11
    RACK2 PS4 15 RACK1 PS3 CB F13
    "IFT/VES 28V" 1 SLAT CONTROL PWR B CB (28 V DC-2) F1

    CB Unit 1

    CB Unit 1 was mounted to the underside of E-rack 1 in Bay 1 and received 48 V DC from PSU 1 and PSU 2. The following CB identifications and ratings are based on HI Drawing 20042 Rev C.

    Table: Power Supply 1

    CB Identification Rating (A) CB Power Source
    MOD 2 20 PSU 1
    SDU 1 7.5 MOD 2 CB
    SDU 5 7.5 SDU 1 CB
    DAU 1 7.5 PSU 1
    MOD 1 5 DAU 1 CB
    SDU 4 15 MOD 1 CB
    CC 1 1 SDU 4 CB
    CC 2 1 CC 1 CB
    CC 3 1 CC 2 CB
    CC 4 1 CC 3 CB
    CC 5 1 CC 4 CB
    CC 6 1 CC 5 CB

    The TSB identified the following discrepancies:

    • The drawing identified the SDU 1 CB as B1-7050; however, the IFEN MM identified this CB as B1-7043.
    • The drawing identified the CC 1-CC 6 CBs as 1 A; however, the IFEN MM, Figure 119 identified these CBs as 0.5 A.
    • The drawing identified the SDU 5 CB as 7.5 A; however, the IFEN MM, Figure 119 identified this CB as 15 A.
    • The drawing identified a "MOD 2 CB"; however, the IFEN MM identified a "MOD 1-2" CB.
    • The drawing identified the MOD 2 CB as 20 A; however, the IFEN MM, Figure 119 identified the MOD 1-2 CB as 5 A.

    Table: Power Supply 2

    CB Identification Rating (A) CB Power Source
    VOD 1 20 PSU 2
    SDU 3 7.5 VOD 1 CB
    SDU 2 7.5 PSU 2
    SDU 6 15 SDU 2 CB
    SP_MOD[1] 2.5 SDU 6 CB
    CFS 4 SP_MOD CB
    CTIU 1 CFS CB
    HDU 1 1 CTIU CB
    HDU 2 1 HDU 1 CB

    The TSB identified the following discrepancies:

    • The drawing identified both SDU 2 and SP_MOD CBs as B1-7043.
    • The drawing identified an "SP_MOD"; however, the IFEN MM, Figure 119 showed "14 CH MOD" and the written description stated "13-Ch MOD." HI has since verified that "SP_MOD" is the same as "13-Ch MOD."
    • The drawing identified the CTIU CB as B1-7046; however, the IFEN MM identified this CB as B1-7045.
    • The drawing identified the SDU 2 CB as B1-7043; however, the IFEN MM identified this CB as B1-7050.
    • The drawing identified B1-7045 as the "CFS" CB; however, the IFEN MM identified it as "CFS2."
    • The drawing identified the HDU 1 and HDU 2 CBs as 1 A; however, the IFEN MM, Figure 119 identified these CBs as 0.5 A.

    CB Unit 2

    CB Unit 2 was mounted to the underside of E-rack 2 in Bay 7 and received 48 V DC from PSU 3 and PSU 4. CB identifications and ratings are based on HI Drawing 20045 Rev A.

    Table: Power Supply 3

    CB Identification Rating (A) CB Power Source
    MOD 1 5 PSU 3
    SDU 11 15 MOD 1 CB
    SDU 12 15 SDU 11 CB
    SDU 9 20 PSU 3
    SDU 17 5 SDU 9 CB
    MOD 2 5 SDU 17 CB
    NSU 3 MOD 2 CB

    IFT indicated that the NSU received power from PSU 4 in accordance with Drawing 20067 Rev N/C. WDM Supplement 20023 Rev D for the IFEN system installation refers to Drawing 20067 for the CB schematic Unit 2. Although this drawing is identified as applicable only to the B747 aircraft, IFT has advised that the drawing is an accurate representation of the Product 99 configuration as installed in the occurrence aircraft. The TSB has not identified any other drawings or documentation that support the use of Drawing 20067. However, there are numerous documents that support the use of Drawing 20045 Rev A.

    • Drawing 12003-501
    • Drawing 20032 Rev A
    • Drawing 20045
    • Drawing 80008
    • IFEN MM
    • QA Final Inspection Checklist for PN 80008-101
    • FAA Form 8130-3 for the E-Rack Installation Kit
    • Drawing 90043-504
    • Drawing 20023 Rev F

    An inspection of two CB Unit 2 panels removed from Swissair aircraft revealed that the wiring for the NSU CB was installed as per Drawing 20045.

    The TSB identified the following discrepancies:

    • The drawing identified the SDU 9 CB as B1-7064; however, the IFEN MM identified this CB as B1-7054.
    • The drawing identifies B1-7061 as the "MOD 1" CB; however, the IFEN MM identified it as "MOD #2-1" and the IFEN MM, Figure 120 shows it as "MOD 1-2."
    • The drawing identifies B1-7066 as the "MOD 2" CB; however, the IFEN MM identified it as "MOD #2-2" and the IFEN MM, Figure 120 showed it as "MOD 2-."

    Table: Power Supply 4

    CB Identification Rating (A) Power Source
    SDU 8 20 PSU 4
    SDU 10 15 SDU 8 CB
    DAU 2 7.5 PSU 4
    VOD 2 20 DAU 2 CB
    HDU 3 1 VOD 2 CB
    HDU 4 1 HDU 3 CB
    CC 8 1 HDU 4 CB
    CC 9 1 CC 8 CB
    CC 10 1 CC 9 CB
    CC 11 1 CC 10 CB
    CC 12 1 CC 11 CB

    At the time of the accident, PSU 4 was installed and powered in HB-IWF, although it was not used to supply electrical power to any of the components in the 61-seat IFEN configuration.

    The TSB identified the following discrepancies:

    • The drawing identified the SDU 8 CB as 20 A; however, the IFEN MM, Figure 120 identified this CB as 15 A.
    • The drawing identified the HDU 3, HDU 4, CC 8, CC 9, CC 10, CC 11, and CC 12 CBs as 1 A; however, the IFEN MM, Figure 120 identifies all of these CBs as 0.5 A.

    Left-Hand Mid-equipment Panel

    The left-hand mid-equipment panel was located between STA 854 and STA 896, approximately 50 inches to the left of the aircraft's centreline. The PSU 5 and PSU 6 three-phase CBs were grouped under the heading "IFT/VES 115VAC POWER RACK 3." The following CB identifications and ratings are based on HI Drawing 90010 Rev B.

    Table: Left-Hand Mid-equipment Panel

    CB Identification Rating (A) CB Power Source
    PSU 5 15 Terminal Strip S3-674 (115 V AC)[2]
    PSU 6 15 PSU 5
    IFT/Printer 115 V 2 PSU 6 CB
    IFT VDU 28 V 1 AISLE LIGHTS CONTROL (28 V DC)

    The TSB identified the following discrepancies:

    • The drawing identified B1-7033 CB as "IFT/VDU"; however, the IFEN MM identified this CB as "VDU."
    • The WDM identified the AISLE LIGHTS CONTROL CB as B1-1065; however, the IFEN MM identified this CB as B1-1063.

    IFEN Wiring

    All of the IFEN cables were custom-made and supplied as part of the installation kit. The CFS, CCs, VODs, and aircraft interface units were connected to the NSU via two twisted-pair cables each. The wiring for both the BDN and the LAN was physically combined in one cable connected to the SDU. The SEB-to-SEB cabling consisted of a single daisy-chained cable that was routed in the seat track between seat groups. This cable was shielded, using both foil and braid shielding for maximum protection from EMI, and was composed of one coaxial cable (to carry broadband data), two shielded twisted-pairs (to carry LAN data), and two power conductors (to distribute power to the seat groups). The SEB-to-SEB cable was terminated in quick-disconnect shielded connectors.

    Contract Specifications

    The Statement of Work contained in the agreement between IFT and HI included the following wiring specifications:

    • All cabling shall be installed per FAR 25.1353 and the installation of cables and harnesses shall meet the applicable requirements of the Boeing or McDonnell Douglas documents.
    • Cabling shall be clamped every 20 to 22 inches and wherever the cable routing changes direction.
    • HI shall meet the separation requirements between IFEN system cabling and existing cabling that are heavy transmitters of electrical power.
    • Cable and harness design and assembly shall follow the guidelines of Boeing and McDonnell Douglas as applicable.
    • Cabling installation drawings shall contain the aircraft station, left or right buttock line, and waterline of each cable run and disconnect location.
    • System cabling interfaces to aircraft power and existing systems will be defined by the airline customer and will be communicated to HI.
    • Single wire used in all cables and harnesses shall meet the requirements of MIL-W-22759.[3]
    • Multiple twisted conductors used in all cables and harnesses shall meet the requirements of MIL-C-27500.
    • Coaxial wire used in cables or harnesses shall meet the requirements of MIL-C-17.

    FAR 25.1353 Specification

    FAR 25.1353 includes the following specifications:

    • Electrical equipment, controls, and wiring must be installed so that operation of any one unit or system of units will not adversely affect the simultaneous operation of any other electrical unit or system essential to the safe operation.
    • Cables must be grouped, routed, and spaced so that damage to essential circuits will be minimized if there are faults in heavy, current-carrying cables.

    Military Specifications for Wire

    MIL-W-22759 specifies the use of fluoropolymer-insulated single conductor electrical wires made with tin-, silver-, or nickel-coated conductors of copper or copper alloy as specified by the applicable specification sheet.

    MIL-W-27500 covers the requirements for special purpose cables and electrical power cables including the basic wire size and type, number of wires, and shield and jacket styles, as specified.

    MIL-C-17 specifies the use of flexible and semi-rigid cables with solid and semi-solid dielectric cores, with single, dual, and twin inner conductors.

    McDonnell Douglas Wiring Guidelines

    McDonnell Douglas wiring guidelines are described in both the MD-11 MM and the WDM.

    The MD-11 MM, Chapter 20, "Standard Practices—Airframe," includes a section on electrical and electronic components. Standard practices included in this chapter include inspection, repair, installation, servicing, and test procedures, among others.

    The WDM, Chapter 20, "Standard Practices," describes generic manufacturing and repair practices applicable to all MDC commercial aircraft, including how to terminate wires, how to install connectors, splices, wire harnesses, wire bundles and grounding straps, how to terminate electrical shields and ground wires, and how to install and maintain electrical and electronic conductors and termination points.

    These practices are similar to the wiring guidelines described in the following FAA ACs:

    • AC 43.13-1A Acceptable Methods, Techniques, and Practices—Aircraft Inspection and Repair
    • AC 65-15A Airframe and Powerplant Mechanics Handbook

    MDC also published additional wiring information, including DPS 1.834-7 Fabricating and Installing Wire Harnesses—Commercial. This proprietary manufacturing document provides extensive information relating to wire manufacturing and installation, including the following procedures:

    • Selecting the size of the plastic strap
    • Routing of wires to mod blocks
    • Grouping and routing wire
    • Using the appropriate bend radius and slack in cables
    • Protecting installed wire bundles

    Because DPS 1.834-7 was proprietary, HI did not identify it as a reference document.

    Power Cable Design Specifications

    In accordance with contract agreements between IFT and HI, the main power supply cable was to be designed and manufactured to conform with MIL-C-27500. This specification included a requirement to use white, blue, and orange circuit identification colours. HI's Cable Assembly A/C[4] Power to Circuit Breaker drawing identified the main power supply cable as PN 60005-101, supplied by Whitmore Wire & Cable. HI Drawing 60005 Cable A/C Power required this cable to be manufactured using three M16878/5-BNL wires, extruded PTFE-insulated wires rated at 200°C, 1 000 V. The wire colours were identified as white, red, and orange. MIL-DTL-16878 included the following specifications:

    • B: Copper-coated conductor material
    • N: 8 AWG
    • L: 133 strands of wire

    The wire could be either tin, silver, or nickel coated. When a material is not specified, a material can be used that will enable the insulated wire to meet the performance requirements of the specification.

    In accordance with contract agreements between IFT and HI, the power cable for each of the power supplies was to be designed and manufactured to conform with MIL-C-27500. This specification included a requirement for white, blue, and orange circuit identification colours. HI's Cable Assembly Circuit Breaker to Rack Disconnect drawing identified the power cable for each of the power supplies as PN M27500A12TE3U00. MIL-C-27500 included the following information:

    • M27500: Cable specification
    • A: Identification method of cable wire and shield coverage (white, blue, orange wire)
    • 12: Conductor size (12 AWG)
    • TE: Basic wire specification (MIL-W-22759/16)
    • 3: Number of wires in cable (3)
    • U: Shield type and material (no shield)
    • 00: Jacket type (no jacket)

    The cable was manufactured by twisting the three wires together and securing them with cable ties.

    IFEN Installation Observations

    The HI EO contained "Accomplishment Instructions" for installing the IFEN kit. Installation activities included aircraft preparation, kit installation, close-up, and return-to-service. Each activity was subdivided into specific tasks that described the required action, the parts required, and in some instances, the applicable reference documents. The mechanic or technician was to acknowledge completion of a task by signing (initialling) in the appropriate signature box adjacent to the task description. The completed tasks were to be subsequently reviewed by an approved inspector; if the inspector determined that the completed tasks were acceptable, the inspector was to sign (initial) in the signature box adjacent to the task description.

    Upon fulfillment of the Accomplishment Instructions, HI prepared FAA Form 337, which confirmed that the IFT IFEN system had been installed in accordance with the applicable HI MDL. HI used FAA Form 337 to assure SR Technics that all work performed by HI was completed in accordance with the FARs and complied with the approved IFEN STC.

    The STC EO section entitled "System Cable Routing Installation" contained the following "Notes":

    • Maintain adequate distance from existing wiring.
    • Ensure a minimum bend radius of 5X-cable thickness.
    • Reference standard practices AC 43.13-1A.

    Installation of the Main Power Cable and PSU CBs – Lower Avionics CB Panel

    Installation information for the main power supply cable and the PSU CBs located in the lower avionics CB panel included Drawings 20023 Rev B, 90049 Rev D, 90010 Rev B, and 50000 Rev C. The HI drawings included the following information:

    • The main power cable assembly, PN 50000-201, had an overall length of approximately 240 inches and contained wires WW55-9000-8WH, -8RD, and -8OR.
    • Wire WW55-9000-8WH was terminated at the "A" terminal of the B1-7025 CB.
    • Wire WW55-9000-8RD was terminated at the "B" terminal of the B1-7025 CB.
    • Wire WW55-9000-8OR was terminated at the "C" terminal of the B1-7025 CB.
    • The main power cable assembly originated at S3-600 and terminated at the B1-7025 CB.
    • The B1-7025 CB was identified as the "Rack 1 PSU1" CB.
    • The main power cable assembly was to be routed outboard from S3-600 to the right side of the fuselage then directed upward through an existing conduit that had been used for routing the 8 AWG bus feed.[5]
    • The main power cable assembly was to be clamped to existing cable runs.
    • Within the avionics compartment, the main power cable assembly was to be supported with nylon clamps in five locations and routed with existing feeder cables.

    The HI EO contained the following information:

    • Locate the CB panel above the observer's station.
    • Install four 15 A CBs in each of the following positions: 7, 9, 11, and 13.
    • Route wire harness assembly 50000-201 from S3-600 at STA 380 to the newly installed 15 A CBs.
    • Terminate cable ends of wire harness assembly 50000-201 at B1-7025.

    The WDM identified S3-600 as a terminal strip located in the avionics compartment at STA 380.

    Discrepancies

    The TSB identified the following discrepancies:

    • The installation drawings did not specify the conduit to be used.
    • The installation drawings did not define the specific routing and installation of the cable assembly from the rear of the lower avionics CB panel to the right side of the fuselage.

    Installation of the 8 AWG Jumper Wires – Lower Avionics CB Panel

    Installation information for the jumper wires for the 15 A power supply CBs located on the lower avionics CB panel included Drawings 20023 Rev B, 60005 Rev A, 90049 Rev D, 90010 Rev B, and 50000 Rev C. The HI drawings included the following information:

    • The PN for the jumper wires was 50000-301.
    • Cable assembly PN 50000-301 contained cable PN 60005-101 and had an overall length of approximately 54 inches.
    • Cable PN 60005-101 consisted of three twisted 8 AWG wires—white, red, and orange.
    • Wire studs were to be crimped to the cable assembly during
      installation.[6]
    • The white 8 AWG jumper wire was to be installed between corresponding "A" terminals of each of the four 15 A CBs.
    • The red 8 AWG jumper wire was to be installed between corresponding "B" terminals of each of the four 15 A CBs.
    • The orange 8 AWG jumper wire was to be installed between corresponding "C" terminals of each of the four 15 A CBs.

    The HI EO contained the following information:

    • Determine the exact lengths of the 50000-301 jumper assemblies that bus the PSU 1-4 CBs.
    • Terminate the jumper assemblies as per the drawing.
    • When connecting the B1-7025 bus side, connect the 50000-201 along with the jumper assemblies.

    Discrepancies

    The cable assembly drawing for PN 50000-301 defined a specific length and shape (54 inches, twisted 8 AWG wires) for the jumper wire; however, the EO indicates that the exact length is to be determined upon installation. It was HI's installation practice to Transportation Safety Board of Canada - AVIATION REPORTS - 1998 - A98H0003

    Transportation Safety Board of Canada
    Symbol of the Government of Canada

     AVIATION REPORTS - 1998 - A98H0003

    Maintenance and Records

    1. Swissair Operating Specifications
    2. Aircraft Information
    3. Aircraft Maintenance History
      1. Inspection Periods
    4. Powerplant Records History
    5. Supplemental Type Certificates
    6. Swissair's Approved Maintenance Program
      1. Swissair Maintenance Program for McDonnell Douglas MD-11
      2. Swissair Reliability Program Authorization
    7. SR Technics Ltd
      1. Maintenance Organization Operating Specifications
      2. FOCA Certificate
      3. Approval Schedule – Aircraft Ratings
      4. Approval Schedule – Engine Ratings
      5. Foreign Certification
      6. Limited Airframe Rating
      7. Limited Engine Rating
      8. Maintenance Organization Exposition Manual
        1. Introduction
        2. Engineering Order
        3. Training
        4. Technical Training
        5. Continuation Training
      9. Quality System
        1. Responsibility for Quality Assurance
        2. Inspection Levels
      10. Reliability Program
        1. Purpose and Objective
        2. Technical Information System
        3. Incidents and Occurrences
    8. Reporting of Defects
      1. SR Technics Reporting Procedures
      2. Mechanical Reliability Reports
      3. Technical Incidents
      4. Service Difficulty Reports
    9. Maintenance Review
      1. Introduction
      2. SR Technics Status List of Engineering Orders
        1. Engineering Order Review Results
      3. MD-11 Airworthiness Directives
      4. Service Bulletins
      5. Daily Technical Reports
      6. Pilot Complaints
      7. Non-routine Structural Maintenance from Last "D Check"
      8. Structural Significant Inspection Items from Last "D Check"
      9. Time-Controlled Components
      10. Aircraft Technical Records
        1. Technical Logbooks
        2. "A Check" Review
        3. IFEN System Maintenance Activity Review
    10. Audits
      1. SR Technics Internal Audit
      2. FOCA Audits
        1. Corrective Actions

    Swissair Operating Specifications

    SWR holds the following operating certificates:

    • FOCA (a member of the JAA) AOC 1017, issued 31 March 1998. Authorized for passenger and cargo operations for the following aircraft: B747-357, MD-11, A310-322, A310-325, A319, A320, and A321.
    • US Department of Transportation, FAA Operations Specifications (En Route Authorization/Limitations/Procedures) Certificate SWRF3221, approved 20 June 1997. Authorized for the following aircraft: B747, A310, and MD-11.
    • Canadian Department of Transport Operating Certificate F-1945 (Foreign Air Carrier), approved 4 December 1995.

    Aircraft Information

    The FOCA Certificate of Registration issued 5 August 1991 for HB-IWF Swissair lists the following information:

    Registered owner's name and address

    Blue Ridge Finance Ltd.
    c/o CODAN Services Ltd.
    Clarendon House, Church Street
    Hamilton HM CX, Bermuda

    Registered operator's name and address

    SWISSAIR, Schweiz
    Luftverkehr AG, Postfach
    8058 Zurich-Flughafen

    Additional aircraft information

    Fuselage: 465
    Export Certificate of Airworthiness (FAA): E274821
    Number of lavatories: 9
    Number of galleys: 14
    Equipped for over-water operation: Yes

    Aircraft Maintenance History

    Table: Aircraft Maintenance History

    Aircraft Total Time to 2 September 1998 36 041 FH
    Aircraft Total Cycles to 2 September 1998 6560
    Last "A Check" Completed 10 August 1998 35 687 FH
    Last "C Check" Completed 10 September 1997 30 696 FH
    Last "D Check" Completed 10 September 1997 30 696 FH

    Inspection Periods

    Table: Applicable Checks

    Maintenance Pre-flight Check Before Each Departure

    "A check" 700 FH
    Note: Escalation of "A check" from 600 to 700 FH was effective 1 October 1997.

    "C check" 6 000 FH
    Note: Escalation of "C check" from 5 200 to 6 000 FH was effective 1 April 1995.

    "D check" 30 000 FH/72 months, whichever occurs first.
    Note: Escalation of the first "D check" from 22 400 FH/60 months to 30 000 FH/72 months was effective 1 June 1996. After the first "D check," the interval is reduced to 22 400 FH/60 months, whichever occurs first.

    A review of the maintenance records verified that all requirements of the approved maintenance program were completed on time or within the tolerance granted to Swissair by the FOCA.

    Powerplant Records History

    The aircraft was delivered to Swissair with three Pratt & Whitney PW4460 model engines installed. McDonnell Douglas SB 72-001, to convert the PW4460 to the PW4462 model, was incorporated on 1 October 1997 under EO 069685.02. At the time of the accident the aircraft was equipped with three Pratt & Whitney PW4462 model engines.

    The Engine Condition Trend Monitoring Reports from 16 June to 1 September 1998, and the Engine Trend Monitoring Watch-List of Swissair PW4462 engines were reviewed; there were no discrepancies directly pertinent to the investigation.

    Engine 1 (SN P723896CN) was removed from aircraft HB-IWG (Swissair) on 2 February 1998, because of performance deterioration. The incoming inspection of the filter and magnetic plug revealed no deposits. Because of engine time accumulated, it was decided that the engine should be overhauled. Normal wear was indicated. High-pressure turbine T1 blades were excessively worn at the tips, and ceramic duct segments were spalled. The T2 rotating air seal was replaced because of a crack. Extensive overhaul maintenance was performed on all areas of the engine, and an engine test was performed in a test cell on 6 April 1998. A module analysis assessment was performed to evaluate performance standards. Total flight hours were 25 753 and total cycles were 4 290. The Engine Condition Report and Engine Test Summary Log were reviewed; there were no discrepancies directly pertinent to the investigation.

    Engine 2 (SN P723856CN) was removed from aircraft HB-IWH (Swissair) on 12 June 1997, for modification. The incoming inspection of the filter and magnetic plug revealed no deposits. Normal wear was indicated. The T2 rotating air seal was replaced because of a crack, and standard overhaul maintenance was performed on other areas of the engine. An engine test was performed in a test cell on 11 August 1997, and a module analysis assessment was performed to evaluate performance standards. Total flight hours at this time were 24 770 and total cycles were 4 439. The Engine Condition Report and Engine Test Summary Log were reviewed; there were no discrepancies directly pertinent to the investigation.

    Engine 3 (SN P733713) was removed from aircraft PH-MCS (Martinair) on 5 April 1996 as a result of an in-flight shutdown. The incoming inspection of the filter and magnetic plug revealed no deposits. The engine disassembly revealed that a fractured T2 blade caused heavy secondary damage to the high-pressure compressor, diffuser case assembly, high-pressure turbine, low-pressure turbine, and main gearbox. Extensive overhaul maintenance was performed on all areas of the engine and an engine test was performed in a test cell on 4 October 1996. A module analysis assessment was performed to evaluate performance standards. At the time of this maintenance, total flight hours were 4 735 and total cycles were 861. The Engine Condition Report and Engine Test Summary Log were reviewed; there were no discrepancies directly pertinent to the investigation.

    Supplemental Type Certificates

    SR Technics aircraft records indicated four STCs incorporated on HB-IWF:

    STC ST01373AT
    Issued: 9 June 1997
    Description: Interior Reconfiguration (Product 97)
    Holder: J.R.G. Design, Inc.
    Greensboro, NC, USA
    STC ST00698AT-D
    Issued: 8 September 1996
    Description: Installation of Airshow 420 System
    Holder: TIMCO
    Greensboro, NC, USA
    STC ST00236LA-D
    Issued: 19 November 1996
    Description: Installation of Interactive Flight Technologies Inc. Entertainment System
    Holder: Santa Barbara Aerospace
    Santa Barbara, CA, USA
    STC TD340LB-T
    Issued: 16 May 1994
    Description: Interior Modification, (Cabin Crew Rest)
    Type Design Designated Engineering Representative Approval
    Holder: McDonnell Douglas Corp.
    Douglas Aircraft Company
    Long Beach, CA, USA

    Swissair's Approved Maintenance Program

    The FOCA Maintenance System Approval Statement (AOC 1017) certified that Swissair was approved under JAR-OPS 1 Subpart M to manage the maintenance of the following aircraft:

    Table: Approved Maintenance Programs

    Aircraft Type Approved Maintenance Program
    A310-322 45-0002
    A310-325 45-0002
    A319 48-0002
    A320 48-0002
    B747-357 46-0002
    MD-11 49-0002

    The SR Technics Engineering department was responsible for the maintenance programs for all Swissair aircraft, with the exception of the B747, which had been subcontracted to KLM.

    Swissair Maintenance Program for
    McDonnell Douglas MD-11

    The FOCA approved the Swissair maintenance program for MD-11 aircraft with the following conditions:

    • All amendments/alterations to the maintenance program were to be approved by the FOCA.
    • It was the responsibility of Swissair to ensure recommendations made by the aircraft or equipment manufacturers were evaluated and, where appropriate, Swissair was to initiate maintenance program amendments.
    • It was the responsibility of Swissair to ensure compliance with all appropriate mandatory requirements issued by the FOCA, and by the recognized airworthiness authority of the country of origin of the aircraft.

    Swissair Reliability Program Authorization

    The FOCA authorized Swissair to participate in the SR Technics MD-11 Reliability Program (98-37146) under the condition that the SR Technics Reliability Program was considered part of the approved Swissair Maintenance Program.

    SR Technics Ltd.

    SR Technics was composed of eight organization areas: Maintenance, Powerplant, Components, Materiel, Engineering and Quality, Finance, Human Resources, and Marketing and Sales. Each of these had a supporting structure to meet their specific business needs. For example, the supporting structure for Maintenance included the following:

    1. Engineering
    2. Management Support
    3. Customer Business and Support
    4. Planning
    5. Workshops
    6. Heavy Maintenance
    7. Line Maintenance Hangar
    8. Line Maintenance Ramp
    9. Line Stations

    Maintenance Organization Operating Specifications

    SR Technics had the following certifications:

    1. FOCA Maintenance Organization Approval Certificate FOCA-001, current issue 14 February 1997, expiry date 27 June 1999;
    2. United States Department of Transportation, FAA Air Agency Certificate SWRY3221 (approved Repair Station) original issue 20 February 1952, current issue 31 July 1998, expiry date 30 June 1999; and
    3. ISO 9001, re-certification December 1995.

    At the time of the accident, based on an authorization issued by the FOCA, SR Technics' Engineering department was authorized to release its own maintenance instructions and to amend maintenance instructions issued by the manufacturer of aircraft, engines, components, or both as described in the MOE. This particular Engineering approval was not applicable to SR Technics' FAA Repair Station certificate.

    FOCA Certificate

    The FOCA Approval Certificate certified SR Technics as a JAR-145 maintenance organization approved to maintain the products listed in the Approval Schedule, issued 24 April 1998, expiry date 24 October 1998.

    Approval Schedule – Aircraft Ratings

    The extent of maintenance that can be performed is specific to aircraft type and series.

    Table: Aircraft and Maintenance Type

    Aircraft Model Base Maintenance Line Maintenance
    McDonnell Douglas DC-9 / MD-80 / DC-10 / MD-11 Series 1 2
    Airbus A310 / A319 / A320 / A321 / A330 Series
    Airbus A300 / A340 Series   2
    Boeing 737 / 757 / 767 / 777 Series
    Fokker F28 MK0100 (F100) 3 2
    Boeing 747 Series
    1: "C check," Intermediate Visit, Heavy Maintenance Visit, "D check"
    2: Pre-flight up to and including "B check" (where applicable)
    3: "C check" only

    Approval Schedule – Engine Ratings

    The extent of maintenance that can be performed is specific to engine type and series.

    Table: Engine Type and Maintenance

    Limitation
    Pratt & Whitney JT8D Series Repair and Complete Overhaul
    Pratt & Whitney JT9D Series Repair, Inspection, Modification, Quick Engine Change Buildup and Limited Parts Refurbishment
    Pratt & Whitney PW4000 Series Repair and Complete Overhaul
    CFM International CFM 56-5 and -7 Series Repair and Complete Overhaul

    Foreign Certification

    The FAA empowered SR Technics to operate an approved Repair Station with the following ratings:

    Table: Repair Station Ratings

    Limited Airframe 28 November 1997
    Limited Engine 9 September 1993
    Limited Emergency Equipment 21 February 1995
    Limited Specialized Services 31 July 1998
    Limited Accessory 20 February 1997
    Limited Instruments 20 February 1997
    Limited Radio 20 February 1997

    Limited Airframe Rating

    Boeing Airplane Company Model B747 100-200-300 (Note 2)
    Model B747-400 (Note 1)
    McDonnell Douglas Model DC-9/MD-80 Series (Note 2)
    DC-10 Series, MD-11 Series (Note 3)
    Airbus Industrie Model A310-200/-300 Series (Note 3)
    Model A319, A320 and A321 Series (Note 2)
    Note 1: Aircraft inspections through "A check" or equivalent and related aircraft maintenance. This does not authorize overhaul or repair of airframe components, airframe appliances, or both, except within the limitations listed in SR Technics FAA accepted-capability list dated 4 February 1997, as revised.
    Note 2: Aircraft inspections through "C check" or equivalent and related aircraft maintenance, including overhaul or repair of airframe components, appliances, or both.
    Note 3: Aircraft inspections through "D check" or equivalent and related airframe maintenance including overhaul or repair of airframe components, appliances, or both.

    Delegated Authorities: None

    Limited Engine Rating

    Pratt & Whitney JT8D Series (Note 1)
    JT9D Series (Note 2)
    PW4000 Series (Note 1)
    CFM International S.A. CFM56 Series (Note 1)

    Note 1: Engine authorization for the aforementioned engines is limited to overhaul and repair of engines in accordance with the applicable engine manufacturer's maintenance manual, as revised.

    Note 2: Engine authorization for the aforementioned engines is limited to inspection, minor repair, adjustment, removal and installation of accessories on the above engines. This does not authorize overhaul or repair of engine components, engine appliances, or both, except within the limitations in SR Technics' FAA-accepted capability list, as revised.

    Delegated Authorities: None

    Maintenance Organization Exposition Manual

    Introduction

    The purpose of the MOE manual (effective date 1 March 1997) was to describe the procedures and policies of SR Technics. Compliance with these procedures assures conformity with the applicable regulations, appropriate manufacturers' manuals, and other approved data, all of which are necessary to obtain and retain certificates and ratings. The MOE is a combined manual covering FOCA/JAA and FAA requirements, and cross-references subjects required by the FAA Foreign Repair Station Inspection Procedures Manual Guidance and Reference Material. The responsibility for compliance with the provisions of the MOE rested with the general managers of the different organizational areas.

    Engineering Order

    An EO is the means by which the Engineering department provides instructions to the applicable work groups to perform specific work activities. EOs originate from an AD, manufacturers' recommendations (e.g., SBs, AOLs;), or from SR Technics internal decisions. An EO can also be generated to incorporate modifications, implement changes in the maintenance programs and fleet inspections, or both. They are published in written form, and compliance is mandatory. An EO deadline date is an agreed-upon date based on the requirements of the Engineering department and of other departments as deemed necessary. This date can be modified, unless the EO is related to an AD, upon approval by the Engineering department. Modifications to the deadline date can be attributed to a variety of reasons, such as availability of vendor-supplied parts.

    Training

    The Technical Training Committee, training coordinators, supervisory personnel, QA departments, and the Personnel Development and Technical Training department worked together to ensure that there were appropriately qualified and trained personnel within SR Technics.

    The Technical Training Committee was chaired by the head of the Personnel Development and Technical Training department and included representatives from all product areas. This committee was responsible for issues pertaining to overall training, including ensuring that the training corresponded with the objectives of SR Technics. Additionally, the committee provided information to managing personnel about the level of training in each product area.

    Each assigned training coordinator was responsible for training issues, and for ensuring that decisions made by the Technical Training Committee were communicated within their specific product areas.

    Within their specific work areas, the supervisory personnel were responsible for introducing a new employee to the workplace, establishing training requirements for each employee, providing on-the-job training, and keeping a training record for each employee.

    Each QA department was responsible for controlling and approving the special procedures for certifying staff. These procedures included qualification profiles and training requirements.

    The Personnel Development and Technical Training department was responsible for executing classroom and practical training and for keeping records of training that had been provided.

    Technical Training

    The MOE describes the training program as including:

    Basic Training

    Basic training mainly consisted of an introductory course, basic courses, and courses specific to aircraft types.

    All new employees received an introductory course on their first day of employment. This included a general presentation of the company, personnel regulations, and a workshop tour in the maintenance base.

    Basic courses provided general knowledge about aeronautical and technical subjects, selected English expressions, and practical instructions on the use of SR Technics work documents and the application of proper methods and routines for carrying out maintenance work. Additionally, these courses included instructions regarding QA, safety regulations, fire protection, and general familiarization with Swissair's documentation, policies and procedures.

    The aircraft-type basic courses consisted of general information about each current aircraft type and supplementary information about the main aircraft sections or systems specific to the area where the employee was to work.

    New employees who had completed their basic training and were working for the first time on an aircraft or in the workshop were to be accompanied and supervised by a qualified person until sufficient knowledge had been obtained.

    System Training

    System training, both theoretical and practical, provided the employee with the specific knowledge and skills needed to meet the requirements of an airframe, powerplant, and electric/avionics specialist, or both.

    Special Training

    Special training provided the employee with the knowledge and skills to meet the requirements of each specific course, such as engine overhaul, run-up, and component overhaul. CAA regulation training was to be provided to supervisory and engineering personnel as well as to all certifying staff.

    On-the-job training, as far as possible and practical, was to be prepared and carried out according to the same principles as basic and special training.

    Each course was followed up with a test and, upon passing with a minimum of 70%, the employee was then permitted to work independently and to sign the work documents.

    Continuation Training

    A continuous evaluation process was used to determine the training requirements beyond what was addressed in the Basic, System, Special, and on-the-job training. It was the responsibility of the head of each department to determine the type and extent of this continuation training.

    Quality System

    Responsibility for Quality Assurance

    Within the Engineering and Quality organization area there were three QA departments. QA Aircraft was assigned to the Aircraft Maintenance and Aircraft Overhaul organization areas, QA Components was assigned to the Components and Power Plant organization areas, and QA Services was assigned to the remaining organization areas. QA was responsible for the performance of required inspections and for planning and performing internal quality audits of the organizational procedures. These departments reported directly to the head of Engineering and Quality, who was responsible for ensuring adherence to the quality standards and requirements for the CAAs, and for ensuring the established quality system was reviewed for compliance with the quality standards, the government and CAA rules, and the company's regulations.

    QA for SR Technics products, particularly the airworthiness of the aircraft and the use of aircraft parts, was the responsibility of the implementing departments, in accordance with relevant job descriptions and procedures.

    Each employee was to be trained to be personally responsible for the quality of his or her work. The work was expected to be accomplished correctly, and the employee was required to perform a "self inspection" after each work step.

    The supervisors of all individual departments were responsible for the following:

    • QA in their specific areas;
    • ensuring their personnel were aware of the required standards, were sufficiently trained and qualified, and had access to appropriate resources;
    • inspecting the quality of their employees' work; and
    • coordinating QA measures.

    Inspection Levels

    There were three levels of inspection: Self, Double, and Required. These inspection levels were determined by a team of specialists, based on two criteria: an analysis of the risk inherent in the performed work and an analysis of the probability and consequences of a failure. Double and Required inspections were only performed in production areas. In administrative areas the requirements for Double inspections were included in internal procedures, wherever appropriate.

    The MOE defined Self, Double, and Required inspections in the following ways.

    Self Inspection

    A Self inspection is required after each work step and is performed by the person who actually did the work. Personnel performing this work must be trained and qualified, and the work must be done in accordance with the applicable regulations, and instructions, procedures, or both.

    Double Inspection

    A Double inspection may be required based on the probability of a failure during the execution of the work and the consequences thereupon. This inspection must always be carried out by a specially trained and qualified person who is not involved in the execution of the work to be inspected, and must be recorded on the applicable working paper. The Self inspection must be carried out prior to performing a Double inspection.

    Required Inspection

    A Required inspection is to be performed if the probability of a failure during the execution of the work may consequently lead to unsafe operation of the aircraft. This inspection must always be carried out by a specially trained and qualified inspector from the QA department assigned to the product area, and must be recorded on the applicable working paper. The Self inspection must be carried out prior to performing a Required inspection.

    Reliability Program

    In accordance with FAA AC 120-17A, administration of the Reliability Program can be assigned to an existing organizational element. In this case, the SR Technics engineering organization: CEA, CRE, or both.

    Regular meetings were scheduled with the Engineering, Maintenance and Quality departments of SR Technics for the purpose of reviewing reliability aspects such as operating performance, airworthiness, and reliability in general.

    Purpose and Objective

    The program's purpose was to establish a management and control system for optimizing aircraft, system, engine and component performance and service life, and to effectively adjust time limitations related to operating experience. The objective of the program was to control and maintain components, systems, and aircraft operated by customers within an acceptable level of airworthiness, reliability, and economics.

    Technical Information System

    SR Technics and the subcontractors' reliability program obtained data from several sources (through the Technical Information System), and the development of this information provided the means for analysing operating experience and quality, and formulating projections. According to the SR Technics procedure manual applicable at the time of the accident, the customer airlines and SR Technics reported to each other all technical information necessary for control of the technical behaviour of the flight equipment. This information was sent to the CEA, which had the sole and exclusive responsibility for fulfilment of all engineering activities. Although the agency could partially delegate responsibilities to other parties, subject to SR Technics and subcontractors' Engineering Group approval, the overall responsibility still rested with the agency.

    The CRE group was responsible for engineering activities related to components (including engines) within SR Technics and the subcontractors.

    The responsible CEA/CRE group analyzed the collected data and made recommendations for time extensions, corrective actions, or additional investigations. The primary objective of these analyses and decisions was to maximize operational safety and airworthiness, and to optimize operational integrity and reliability.

    Incidents and Occurrences

    All technical events that had a direct influence on flight safety or had negative operational consequences leading up to "emergency procedures" or abnormal operations were considered as incidents. Technical events or consequences that were not classified as incidents were considered occurrences.

    Reporting of Defects

    SR Technics Reporting Procedures

    SR Technics was required to report to the FOCA, the manufacturer, and, where applicable, the operator any un-airworthy condition found during maintenance that might have seriously compromised the airworthiness of the aircraft. The Engineering department would provide information to the liaison aviation authorities, who in turn were to submit the report to the FOCA. This information would be reported to the FOCA within three days, and submitted on special forms.

    As an FAA-approved foreign repair station, SR Technics was required to report, with respect to United States-registered aircraft, any serious defect in, or other recurring un-airworthy condition of any aircraft, powerplant, propeller, or a component of any of them. These reports were to be submitted to a central collection point as specified by the FAA administrator, and in a format acceptable to the administrator. SR Technics used FAA Form 8010-4, Malfunction or Defect Report, for this purpose. The completed form was to be forwarded to the liaison aviation authorities who, in turn, were to submit the report to the FAA.

    Although SR Technics did not differentiate between airlines in their treatment of these events, they did not, nor was there a need to, forward any reports to the FAA with respect to the Swissair fleet.

    Mechanical Reliability Reports

    The 14 CFR, Part 129, did not require Swissair to provide mechanical reliability reports to the FAA.

    Technical Incidents

    The technical incident information was included in the MD-11 monthly reliability reports, which at the time of the accident included data for Swissair, KLM, Garuda, Thai International, Citybird and Martinair. This report was presented in such a manner that each airline had its own section, and each section contained reports titled Technical Incidents & Occurrences and Technical Incident Description.

    The Technical Incidents & Occurrences report identified the number of incidents per month, the number of occurrences per month, and the consequences of these events per month. The categories for each of these sections are based on 14 CFR, Part 121.703, requirements.

    The Technical Incident Description report included the following: